SAML logout does'nt work

[Elise]

> Why do you think you need server side storage anyway?

Because of documentation
(https://wiki.shibboleth.net/confluence/display/IDP30/LogoutConfiguration) :
we have choice between client-side with HTML LocalStorage or server-side
storage. We tried both, and for server-side, memory storage and database
storage. We eventually use database to control a clustering solution.

Here a example of an assertion and the logout request matching :

<?xml version="1.0" encoding="UTF-8"?>
<saml2p:Response
    Destination="https://my.service.test/saml/SAMLAssertionConsumer"
    ID="_0a9025511b57f31fd82cad7487e3fa6a"
    InResponseTo="_732dc5b2-dcbf-4393-ab69-73ff5fbb09f6"
    IssueInstant="2017-03-15T09:33:38.961Z" Version="2.0"
xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml2:Issuer
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://id-provider.insee.test/idp/shibboleth</saml2:Issuer>
    <saml2p:Status>
        <saml2p:StatusCode
Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
    </saml2p:Status>
    <saml2:Assertion ID="_978ecddf3997555a349c10edb160d6be"
        IssueInstant="2017-03-15T09:33:38.961Z" Version="2.0"
        xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
xmlns:xsd="http://www.w3.org/2001/XMLSchema">
       
<saml2:Issuer>https://id-provider.insee.test/idp/shibboleth</saml2:Issuer>
        <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
		......
        </ds:Signature>
        <saml2:Subject>
            <saml2:NameID
                Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
                NameQualifier="https://id-provider.test/idp/shibboleth"
                SPNameQualifier="https://my.service.test/"
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">*_de058c68575e76208c59c5b9ebd727d5*</saml2:NameID>
            <saml2:SubjectConfirmation
Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <saml2:SubjectConfirmationData Address="10.54.108.172"
                    InResponseTo="_732dc5b2-dcbf-4393-ab69-73ff5fbb09f6"
                    NotOnOrAfter="2017-03-15T09:38:39.179Z"
Recipient="https://my.service.test/saml/SAMLAssertionConsumer"/>
            </saml2:SubjectConfirmation>
        </saml2:Subject>
        <saml2:Conditions NotBefore="2017-03-15T09:33:38.961Z"
NotOnOrAfter="2017-03-15T09:38:38.961Z">
            <saml2:AudienceRestriction>
                <saml2:Audience>https://my.service.test/</saml2:Audience>
            </saml2:AudienceRestriction>
        </saml2:Conditions>
        <saml2:AuthnStatement AuthnInstant="2017-03-15T09:33:37.838Z"
SessionIndex="_a174a6365c2f155c617a3c94fbeff9e3">
            <saml2:SubjectLocality Address="..."/>
            <saml2:AuthnContext>
               
<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
            </saml2:AuthnContext>
        </saml2:AuthnStatement>
        <saml2:AttributeStatement>
			......
        </saml2:AttributeStatement>
    </saml2:Assertion>
</saml2p:Response>


<?xml version="1.0" encoding="UTF-8"?>
<saml2p:LogoutRequest
    Destination="https://id-provider.test/idp/profile/SAML2/Redirect/SLO"
    ID="_460f729f-b0fc-433c-a746-b4b36f13212d"
    IssueInstant="2017-03-15T09:33:43.189Z"
    Reason="urn:oasis:names:tc:SAML:2.0:logout:user" Version="2.0"
    xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml2:Issuer>https://my.service.test/</saml2:Issuer>
    <saml2:NameID
        Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
NameQualifier="https://id-provider.test/idp/shibboleth">*_de058c68575e76208c59c5b9ebd727d5*</saml2:NameID>
</saml2p:LogoutRequest>


> That's likely a pointer to something in the database

We don't have a other table in our database. Is it normal ?

Thank you

grotecos



--
View this message in context: http://shibboleth.1660669.n2.nabble.com/SAML-logout-does-nt-work-tp7631969p7631982.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.