SP Initiated Logout with failed IDP logout request

[Bryan Madaras]

We manage a SP which authenticates with multiple different IDPs with which if they provide a SingleLogoutService we will attempt to make the request to the IDP to logout the session, some of the IDPs we interact with the request fails we we work with them to figure out why that is happening.

The question I have is when we logout and the IDP logout request either fails or doesn’t respond we remove our local session.

2021-07-06 15:23:10 DEBUG Shibboleth.LogoutInitiator.SAML2 [13354] [arms]: no compatible front channel SingleLogoutService, trying back channel...
2021-07-06 15:23:10 WARN Shibboleth.LogoutInitiator.SAML2 [13354] [arms]: IdP didn't respond to logout request
2021-07-06 15:23:10 INFO Shibboleth.SessionCache [13354] [arms]: removed session (_fe79f2e565bbc73eda8aa92ad59bd66e)


Disclaimer, my assumption may be incorrect as to what should happen.

Then when the User goes to log back in my assumption is that because the SP session has been removed that the user would need to re-authenticate with the IDP after following the directions of closing the browser to completely logout.

What I am seeing is that the user seems to be able to directly log back in.

2021-07-06 15:26:04 DEBUG Shibboleth.Listener [13358]: dispatching message (get::RelayState)
2021-07-06 15:26:04 DEBUG Shibboleth.Listener [13358] [arms]: dispatching message (arms/Login::run::SAML2SI)
2021-07-06 15:26:04 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [13358] [arms]: validating input
2021-07-06 15:26:04 DEBUG OpenSAML.MessageEncoder.SAML2 [13358] [arms]: tracking request (_77d0c02377eada152a379ca575a78813) against RelayState token (ss:mem:ff069fdfab3d461798c56f02cf7709a4fe713e102ff6347798efd0aaa771b742)
2021-07-06 15:26:04 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [13358] [arms]: marshalling, deflating, base64-encoding the message
2021-07-06 15:26:04 DEBUG XMLTooling.XMLObject [13358] [arms]: starting to marshal samlp:AuthnRequest
2021-07-06 15:26:04 DEBUG XMLTooling.XMLObject [13358] [arms]: creating root element to marshall
2021-07-06 15:26:04 DEBUG XMLTooling.XMLObject [13358] [arms]: marshalling namespace attributes for XMLObject
2021-07-06 15:26:04 DEBUG XMLTooling.XMLObject [13358] [arms]: marshalling text and child elements for XMLObject
2021-07-06 15:26:04 DEBUG XMLTooling.XMLObject [13358] [arms]: starting to marshalling saml:Issuer
2021-07-06 15:26:04 DEBUG XMLTooling.XMLObject [13358] [arms]: creating root element to marshall
2021-07-06 15:26:04 DEBUG XMLTooling.XMLObject [13358] [arms]: marshalling namespace attributes for XMLObject
2021-07-06 15:26:04 DEBUG XMLTooling.XMLObject [13358] [arms]: marshalling text and child elements for XMLObject
2021-07-06 15:26:04 DEBUG XMLTooling.XMLObject [13358] [arms]: caching DOM for XMLObject
2021-07-06 15:26:04 DEBUG XMLTooling.XMLObject [13358] [arms]: starting to marshalling samlp:NameIDPolicy
2021-07-06 15:26:04 DEBUG XMLTooling.XMLObject [13358] [arms]: creating root element to marshall
2021-07-06 15:26:04 DEBUG XMLTooling.XMLObject [13358] [arms]: marshalling namespace attributes for XMLObject
2021-07-06 15:26:04 DEBUG XMLTooling.XMLObject [13358] [arms]: marshalling text and child elements for XMLObject
2021-07-06 15:26:04 DEBUG XMLTooling.XMLObject [13358] [arms]: caching DOM for XMLObject
2021-07-06 15:26:04 DEBUG XMLTooling.XMLObject [13358] [arms]: caching DOM for XMLObject (document is bound)
2021-07-06 15:26:04 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [13358] [arms]: marshalled message:
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="https://sso.armssoftware.com/Shibboleth.sso/SAML2/POST" Destination="https://login.microsoftonline.com/9030beae-3cfc-4788-a9e2-130204ff1f10/saml2" ID="_77d0c02377eada152a379ca575a78813" IssueInstant="2021-07-06T15:26:04Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://sso.armssoftware.com/sp/shibboleth</saml:Issuer><samlp:NameIDPolicy AllowCreate="1"/></samlp:AuthnRequest>


I seem to either have made a bad assumption or I am not understanding how the StorageService works, which we have configured as following

<StorageService type="Memory" id="mem" cleanupInterval="900"/>
<SessionCache type="StorageService" StorageService="mem" cacheAssertions="false" cacheAllowance="900" inprocTimeout="900" cleanupInterval="900"/>
<ReplayCache StorageService="mem”/>


-Bryan