SLO not working properly in IE

[Peters C.L.]

Okey doke, I'll raise a bug.

Maybe it's something Tomcat-specific then as that's what I'm using. The Set-Cookie header I was looking at in IE definitely didn't have an Expire setting on it, though comparing it to what you're seeing from Jetty, I'm not seeing a Version setting either.

Clayton
________________________________________
From: users [users-bounces at shibboleth.net] on behalf of Cantor, Scott [cantor.2 at osu.edu]
Sent: 13 March 2017 13:39
To: Shib Users
Subject: RE: SLO not working properly in IE

> After I successfully logout, and then try to log in again, I get an Exception
> thrown, in particular a ConstraintViolationException: context cannot be null
> or empty.

I don't, but I'm not using the memcache plugin. Even so, that constraint should apply to any storage back end for the most part.

> Sadly this doesn't give a full stack trace, but I've tracked this down
> to the MemcachedStorageService class being given an empty string for a
> context parameter, which seems to be caused by the shib_idp_session
> cookie being blank rather than not existing.

I can't imagine that making any real difference but I'll review the session handling code for an empty check, that's an easy enough adjustment. Please file a bug.

> This seems to be caused by single
> log-out where Shibboleth attempts to expire the cookie by setting Max-Age
> on the cookie to 0 - something which IE doesn't seem to support. (this link
> has a demo: https://balanceiskey.github.io/2015/11/25/ie11-cookies.html).

Max-Age doesn't have to be supported, it should be honoring the expires setting.

Jetty sends:

Set-Cookie: shib_idp_session=;Version=1;Path=/idp;Expires=Thu, 01-Jan-1970 00:00:00 GMT;Max-Age=0;HttpOnly

Of course, that could be container specific. Far be it from me to assume Tomcat isn't broken.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net