SAML logout does'nt work

[Cantor, Scott]

> we are trying to use V3.3.0 of IDP. We previously use the V2 where SAML
> logout worked.

That's a very kind characterization of "didn't work really at all". Logout support in V2 was very limited and certainly not workable in most/many scenarios.

> By using database storage, we saw a difference between specifications of
> the session indexes (from https://wiki.shibboleth.net/confluence/display/IDP30/Sessions) and what
> we actually see in the database.

I doubt very much you're interpreting what you're seeing correctly, so I wouldn't be wasting my time like that.

You should focus on what the logout request looks like as compared to the original assertion issued, but I guess if you're convinced the database isn't set up properly, then you'll have to work that out or find a different storage choice. Why do you think you need server side storage anyway? Just use the client option.

> What we see that could create errors in SAML logout is the column "value".
> In both case, primary and secondly index, we have an incremental number.

That's likely a pointer to something in the database, but I can't speak to that, bottom line is it has to be a Text/Longdata column, and yes, you're correct that the secondary record's value will point back to the IdP session record key.

-- Scott