SAML logout does'nt work

[Cantor, Scott]

On 3/15/17, 5:52 AM, "users on behalf of Elise" <users-bounces at shibboleth.net on behalf of hamelinelise at orange.fr> wrote:

> Why do you think you need server side storage anyway?

> Because of documentation
> we have choice between client-side with HTML LocalStorage or server-side
>storage. We tried both, and for server-side, memory storage and database
> storage. We eventually use database to control a clustering solution.

Right, but why would you pick a database over client? I really am asking, because one of those is much, much, much harder, and it eliminates the HA property of a cluster in most cases.

It's also apparently causing your problem, which is the other reason I asked.

As far as the two messages, I do note the SPNameQualifier is missing from the LogoutRequest, *but*, I think that shouldn't be a problem as long as the IdP is doing things properly, it should be defaulting it in as the SP name. But that could be a bug (just speculating). It's not good practice for any SP to go changing things that way, just out of conservatism.

> > That's likely a pointer to something in the database
>
> We don't have a other table in our database. Is it normal ?

I have no idea what your database even is, I was just speculating you're "viewing" data in your database that because of how you're looking at it doesn't reflect the actual data it's storing, but I really wouldn't know. We have no control over it, or how you created the table, or how your ORM mappings might be operating to get the data stored properly. All of that is out of my scope of support.

What I would suggest is using client-side storage as a test, to verify that the SP's logout request does actually work. If that checks out, then you know the issue is with your database.

Of course you can also just not use the database period, but as a debugging step, that would be my initial suggestion. If the SP request fails in that case, then I would say the IdP has a bug.

-- Scott