SP not processing SAML2 Logout

[Catalin Iosif]

Thanks again, Scott!

Any suggestions on how to investigate a potential issue with the sessions? On the surface, it looks ok - login works, and we're still logged in when re-opening the app URL. Could we have messed up a setting in the config? Could it be something related to the SP cookies?

Here's our sessions tag in case it helps:

<Sessions lifetime="120" timeout="10" cookieLifetime="600" relayState="ss:mem" handlerURL="/anon.sso"
                  checkAddress="false" handlerSSL="true" cookieProps="https">

            <SSO entityID="https://anon/auth/realms/anon">
              SAML2
            </SSO>

            <!-- SAML and local-only logout. -->
            <!-- <Logout>SAML2 Local</Logout> -->

            <LogoutInitiator type="SAML2" Location="/Logout2">
            </LogoutInitiator>

            <!-- Extension service that generates "approximate" metadata based on SP configuration. -->
            <Handler type="MetadataGenerator" Location="/Metadata" signing="false" />

            <!-- Status reporting service. -->
            <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>

            <!-- Session diagnostic service. -->
            <Handler type="Session" Location="/Session" showAttributeValues="false"/>

            <!-- JSON feed of discovery information. -->
            <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
        </Sessions>

Thanks!

Catalin Iosif
Software Engineer

nShift
________________________________
From: Cantor, Scott <cantor.2 at osu.edu>
Sent: Sunday, March 10, 2024 3:40 PM
To: Catalin Iosif <catalin.iosif at nshift.com>; Shib Users <users at shibboleth.net>
Subject: Re: SP not processing SAML2 Logout

[You don't often get email from cantor.2 at osu.edu. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]

> Thanks for replying! Are sure this is from the wrong log?

No, I was incorrect, that's the right one.

> Also, from having a quick look at the source code, is there a chance that it's
> not finding a session

Most likely. That looks like a attempt to start a logout from the SP, and it has no matching session to operate on.

-- Scott


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240311/5b9d79ac/attachment.htm>