SAML logout does'nt work

[Elise]

Cantor, Scott E. wrote
> What I would suggest is using client-side storage as a test, to verify
> that the SP's logout request does actually work.

When I try client-side storage ( with configurations :
idp.storage.htmlLocalStorage = true
idp.session.StorageService = shibboleth.ClientSessionStorageService)
I have this same error. Do you need more logs ?

<saml2:Assertion ID="_fdeee15738b1cf79d413bf35752d7931"
    IssueInstant="2017-03-15T14:48:38.108Z" Version="2.0"
    xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
xmlns:xsd="http://www.w3.org/2001/XMLSchema">
    <saml2:Issuer>https://id-provider.test/idp/shibboleth</saml2:Issuer>
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
	.....
    </ds:Signature>
    <saml2:Subject>
        <saml2:NameID
            Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
            NameQualifier="https://id-provider.test/idp/shibboleth"
            SPNameQualifier="https://my.service.test/"
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">AAdzZWNyZXQxie+RtyXQpwzzeQ50gPRRUqMZrv8HQj+wXfLPKcy9k6f/7y1njAsyPfqDEkVt8yymcLiftdZK4XBOlqpU9sUVtOp6xwR+ilcHE51W/uGCPAfnTVexO2Vr/0zUXi0+9fYlY+JmCE0lXFMTvXZdn8RV</saml2:NameID>
        <saml2:SubjectConfirmation
Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
            <saml2:SubjectConfirmationData Address="10.54.108.172"
                InResponseTo="_acaa0462-5944-4574-bb70-38fde7f55502"
                NotOnOrAfter="2017-03-15T14:53:38.201Z"
Recipient="https://my.service.test/saml/SAMLAssertionConsumer"/>
        </saml2:SubjectConfirmation>
    </saml2:Subject>
    <saml2:Conditions NotBefore="2017-03-15T14:48:38.108Z"
NotOnOrAfter="2017-03-15T14:53:38.108Z">
        <saml2:AudienceRestriction>
            <saml2:Audience>https://my.service.test/</saml2:Audience>
        </saml2:AudienceRestriction>
    </saml2:Conditions>
    <saml2:AuthnStatement AuthnInstant="2017-03-15T14:48:26.782Z"
SessionIndex="_508409c6434dcbce96aa25c94494b976">
        <saml2:SubjectLocality Address="...."/>
        <saml2:AuthnContext>
           
<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
        </saml2:AuthnContext>
    </saml2:AuthnStatement>
    <saml2:AttributeStatement>
	....
    </saml2:AttributeStatement>
</saml2:Assertion>
	
	
<?xml version="1.0" encoding="UTF-8"?>
<saml2p:LogoutRequest
    Destination="https://id-provider.test/idp/profile/SAML2/Redirect/SLO"
    ID="_7a77395a-0892-419c-a636-ea8611771657"
    IssueInstant="2017-03-15T14:49:29.120Z"
    Reason="urn:oasis:names:tc:SAML:2.0:logout:user" Version="2.0"
    xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml2:Issuer>https://my.service.test/</saml2:Issuer>
    <saml2:NameID
        Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
NameQualifier="https://id-provider.test/idp/shibboleth">AAdzZWNyZXQxie+RtyXQpwzzeQ50gPRRUqMZrv8HQj+wXfLPKcy9k6f/7y1njAsyPfqDEkVt8yymcLiftdZK4XBOlqpU9sUVtOp6xwR+ilcHE51W/uGCPAfnTVexO2Vr/0zUXi0+9fYlY+JmCE0lXFMTvXZdn8RV</saml2:NameID>
</saml2p:LogoutRequest>


2017-03-15 15:49:29,245 - DEBUG
[net.shibboleth.idp.session.impl.StorageBackedSessionManager:828] -
Performing secondary lookup on service ID https://my.service.test/ and key
AAdzZWNyZXQxie+RtyXQpwzzeQ50gPRRUqMZrv8HQj+wXfLPKcy9k6f/7y1njAsyPfqDEkVt8yymcLiftdZK4XBOlqpU9sUVtOp6xwR+ilcHE51W/uGCPAfnTVexO2Vr/0zUXi0+9fYlY+JmCE0lXFMTvXZdn8RV
2017-03-15 15:49:29,245 - DEBUG
[net.shibboleth.idp.session.impl.StorageBackedSessionManager:792] -
Performing primary lookup on session ID
6790c8a73c901a8324fef8ab614386cc4b3933cb0845d8a86ccbd41da32e6a12
2017-03-15 15:49:29,245 - DEBUG
[net.shibboleth.idp.session.impl.StorageBackedIdPSession:615] - Loading
SPSession for service https://my.service.fr/ in session
6790c8a73c901a8324fef8ab614386cc4b3933cb0845d8a86ccbd41da32e6a12
2017-03-15 15:49:29,245 - DEBUG
[net.shibboleth.idp.session.SPSessionSerializerRegistry:86] - Registry
located StorageSerializer of type
'net.shibboleth.idp.saml.session.impl.SAML2SPSessionSerializer' for
SPSession type 'class net.shibboleth.idp.saml.session.SAML2SPSession'
2017-03-15 15:49:29,245 - DEBUG
[net.shibboleth.idp.saml.saml2.profile.impl.ProcessLogoutRequest:274] -
Profile Action ProcessLogoutRequest: IdP session
6790c8a73c901a8324fef8ab614386cc4b3933cb0845d8a86ccbd41da32e6a12 does not
contain a matching SP session
2017-03-15 15:49:29,245 - INFO
[net.shibboleth.idp.saml.saml2.profile.impl.ProcessLogoutRequest:320] -
Profile Action ProcessLogoutRequest: No active session(s) found matching
LogoutRequest
2017-03-15 15:49:29,245 - WARN
[org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event
occurred while processing the request: SessionNotFound

grostecos





--
View this message in context: http://shibboleth.1660669.n2.nabble.com/SAML-logout-does-nt-work-tp7631969p7631990.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.