Custom SLO - NameId problem in a IDP initiated LogoutRequest

[iljkr at tiscali.it]

  I have this scenario:
-a Shibboleth IDPv4
-two SP: SP_A and
SP_B
(Shibbolet SPv2 with apache)

I tested with succes the SLO offered
by default by shibboleth idp with the velocity templates.

In
alternative to the SLO by the default logout.vm we are implementing a
managed logout in a custom java servlet.

In my java servlet:

>From the
http request I have successfully extracted the object
net.shibboleth.idp.session.context.LogoutContext relative to the
execution parameter (e.g. 'e1s1',..).

>From the LogoutContext, and
accessing the configuration files in the idp (e.g. metadata file) I
recovered all the info I need to build a logout response for the
SP.

All works fine (with only one SP) and I have a succes logout
response sent from the IDP to the SP.

When there are more than one SP,
I'm trying to build an "IDP initiated logout request" to the other
SP.

I build a simple logout request, but I get a Logout Response from
the SP with the status

urn:oasis:names:tc:SAML:2.0:status:RequestDenied, I think my problem is
with the NameID:

 https://my-idp-name/
 ???????? 

_another_random_uid

I'm trying various combination for the attribute
NameQualifier and for the value of NameID.

NameQualifier should be the
entityid of the idp or the sp?

The value of the NameID it's something I
can find in some object from:

Multimap multimap =
logoutContext.getSessionMap();

?

Or in other object..?

Setting to
debug level the logs of the SP he gave me no further details.

IJ. 



VOUCHER CONNETTIVITÀ per P.IVA e PMI: internet a canone 0 per 48 mesi. ATTIVA ORA
 https://casa.tiscali.it/promo/?u=https://promozioni.tiscali.it/voucher_business/?r=TS00000A00025&dm=link&p=tiscali&utm_source=tiscali&utm_medium=link&utm_campaign=voucherbusiness&wt_np=tiscali.link.footermail.voucherbusiness.btb..

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230112/cf34e68a/attachment.htm>