Custom SLO - NameId problem in a IDP initiated LogoutRequest

[iljkr at tiscali.it]

I send again because I don't understand why the xml code was
"censored": 

I have this scenario:
-a Shibboleth IDPv4
-two SP: SP_A
and SP_B
(Shibbolet SPv2 with apache)

I tested with succes the SLO
offered by default by shibboleth idp with the velocity templates.

In
alternative to the SLO offered by the default logout.vm we are
implementing a managed logout in a custom java servlet.

With a modified
logout.vm which does nothing except redirect to my servlet:

In my java
servlet:

>From the http request I have successfully extracted the object
net.shibboleth.idp.session.context.LogoutContext relative to the
execution parameter (e.g. 'e1s1',..).

>From the LogoutContext, and
accessing the configuration files in the idp (e.g. metadata file) I
recovered all the info I need to build a logout response for the
SP.

All works fine (with only one SP) and I have a succes response from
the SP.

When there are more than one SP, I'm trying to build an "IDP
initiated logout request" to the other SP.

I build a simple logout
request, but I get a Logout Response from the SP with the status

urn:oasis:names:tc:SAML:2.0:status:RequestDenied, I think my problem is
with the NameID:

*saml2p:LogoutRequest
xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" 

Destination="https://SP_B/Shibboleth.sso/SLO/Redirect"

ID="_random_uid"
 IssueInstant="2023-01-12T14:49:18.187Z"

Version="2.0"
 *
 *saml2:Issuer
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"*https://my-idp-name/*/saml2:Issuer*

*saml:NameID NameQualifier="*????????*/"
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
*????????*/saml:NameID* 

*saml2p:SessionIndex*_another_random_uid*/saml2p:SessionIndex*
*/saml2p:LogoutRequest*

I'm
trying various combination for the attribute NameQualifier and for the
value of NameID.

NameQualifier should be the entityid of the idp or the
sp?

The value of the NameID it's something I can find in some object
from:

Multimap multimap = logoutContext.getSessionMap();

?

Or in
other object..?

Setting to debug level the logs of the SP he gave me no
further details.

IJ.  


VOUCHER CONNETTIVITÀ per P.IVA e PMI: internet a canone 0 per 48 mesi. ATTIVA ORA
 https://casa.tiscali.it/promo/?u=https://promozioni.tiscali.it/voucher_business/?r=TS00000A00025&dm=link&p=tiscali&utm_source=tiscali&utm_medium=link&utm_campaign=voucherbusiness&wt_np=tiscali.link.footermail.voucherbusiness.btb..

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230112/3aa40aa1/attachment.htm>