SLO not working properly in IE

[Andrew Morgan]

On Mon, 13 Mar 2017, Cantor, Scott wrote:

>> Maybe it's something Tomcat-specific then as that's what I'm using. The Set-
>> Cookie header I was looking at in IE definitely didn't have an Expire setting on
>> it, though comparing it to what you're seeing from Jetty, I'm not seeing a
>> Version setting either.
>
> That's a Tomcat bug then, I would imagine, but that's really useful 
> information since it may be at the root of a variety of issues people 
> have with it. Of course, we advise against it for a reason.
>
> Anyway, I did spot the session cache code directly consuming getValue, 
> which it shouldn't be doing and the fix should be trivial. Just in time 
> for a patch release so good timing. I'll scour the code for all cookie 
> accesses.

When I access /idp/profile/Logout, I get the following header:

   Set-Cookie: shib_idp_session=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/idp; HttpOnly

This is IDP v3.3 running under Tomcat v8.0.26.

 	Andy