SAML logout does'nt work

[Elise]

Hi,

we are trying to use V3.3.0 of IDP. We previously use the V2 where SAML
logout worked.
Login works correctly in the new version, logout with the servlet /Logout
works too (but not SLO), but we can't make a SAML logout in the new version.

By reading the web documentation we already:

-- put Storage service on server side : we choose eventually a database
storage.

-- put parameters idp.session.trackSPSessions = true and
idp.session.secondaryServiceIndex = true

-- try to increase idp.session.defaultSPlifetime and idp.session.slop
properties(but default timeout should be enough)


What we can see in logs when we're trying saml logout :


2017-03-08 16:34:28,891 - DEBUG
[net.shibboleth.idp.session.impl.StorageBackedSessionManager:828] -
Performing secondary lookup on service ID
https://s54-fedid-t01.ad.insee.intra:7043/ and key
_86a2d0c82e388807caa7cfc56f48b188
2017-03-08 16:34:28,906 - DEBUG
[net.shibboleth.idp.session.impl.StorageBackedSessionManager:792] -
Performing primary lookup on session ID
b61d3216cc2ffc792b0c4d68ae8e4db32a932fa66aecdea6b443da3eb71790e6
2017-03-08 16:34:28,922 - DEBUG
[net.shibboleth.idp.session.impl.StorageBackedIdPSession:615] - Loading
SPSession for service https://my.service.test/ in session
b61d3216cc2ffc792b0c4d68ae8e4db32a932fa66aecdea6b443da3eb71790e6
2017-03-08 16:34:28,922 - DEBUG
[net.shibboleth.idp.session.SPSessionSerializerRegistry:86] - Registry
located StorageSerializer of type
'net.shibboleth.idp.saml.session.impl.SAML2SPSessionSerializer' for
SPSession type 'class net.shibboleth.idp.saml.session.SAML2SPSession'
2017-03-08 16:34:28,922 - DEBUG
[net.shibboleth.idp.saml.saml2.profile.impl.ProcessLogoutRequest:274] -
Profile Action ProcessLogoutRequest: IdP session
b61d3216cc2ffc792b0c4d68ae8e4db32a932fa66aecdea6b443da3eb71790e6 does not
contain a matching SP session
2017-03-08 16:34:28,922 - INFO
[net.shibboleth.idp.saml.saml2.profile.impl.ProcessLogoutRequest:320] -
Profile Action ProcessLogoutRequest: No active session(s) found matching
LogoutRequest
2017-03-08 16:34:28,937 - WARN
[org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event
occurred while processing the request: SessionNotFound


By using database storage, we saw a difference between specifications of the
session indexes (from
https://wiki.shibboleth.net/confluence/display/IDP30/Sessions) and what we
actually see in the database.

In our databases we see for instance :
<http://shibboleth.1660669.n2.nabble.com/file/n7631969/database.png> 


(the three first line are relative to the primary index, the last to the
secondary)

What we see that could create errors in SAML logout is the column "value".
In both case, primary and secondly index, we have an incremental number.
Instead of this, according to specifications, this column should show
serialized session info in the first index case, and should show the session
id in the second index case which can be matched to the idp session.

We think this is related to the "session not found" that we see in logs : 
these lines can't be matched without a common key, the idp session id.

Is there a bad configuration in our server ?

Thanks in advance,

grotecos 



--
View this message in context: http://shibboleth.1660669.n2.nabble.com/SAML-logout-does-nt-work-tp7631969.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.