SLO not working properly in IE

[Cantor, Scott]

> After I successfully logout, and then try to log in again, I get an Exception
> thrown, in particular a ConstraintViolationException: context cannot be null
> or empty.

I don't, but I'm not using the memcache plugin. Even so, that constraint should apply to any storage back end for the most part.

> Sadly this doesn't give a full stack trace, but I've tracked this down
> to the MemcachedStorageService class being given an empty string for a
> context parameter, which seems to be caused by the shib_idp_session
> cookie being blank rather than not existing.

I can't imagine that making any real difference but I'll review the session handling code for an empty check, that's an easy enough adjustment. Please file a bug.

> This seems to be caused by single
> log-out where Shibboleth attempts to expire the cookie by setting Max-Age
> on the cookie to 0 - something which IE doesn't seem to support. (this link
> has a demo: https://balanceiskey.github.io/2015/11/25/ie11-cookies.html).

Max-Age doesn't have to be supported, it should be honoring the expires setting.

Jetty sends:

Set-Cookie: shib_idp_session=;Version=1;Path=/idp;Expires=Thu, 01-Jan-1970 00:00:00 GMT;Max-Age=0;HttpOnly

Of course, that could be container specific. Far be it from me to assume Tomcat isn't broken.

-- Scott