<font class="Apple-style-span" face="arial, sans-serif">I am using Hungarian Shib IDP 2.2.1 on the IDP side to implement IDP initiated SLO.</font><div><font class="Apple-style-span" face="arial, sans-serif"><br></font></div>
<div><font class="Apple-style-span" face="arial, sans-serif">On the SP side, i am using Logical SPs ( with Shibooleth SP 2.4.2) to map two applications hosted on my SSO setup.</font></div><div><font class="Apple-style-span" face="arial, sans-serif"><br>
</font></div><div><font class="Apple-style-span" face="arial, sans-serif">When both the applications are logged in to the SSO for a user and i initate a Global Logout from one of them, the IDP is invoking <LogoutRequest> to all the Logical SPs sequentially.</font></div>
<div><font class="Apple-style-span" face="arial, sans-serif"><br></font></div><div><span class="Apple-style-span" style="font-family: arial, sans-serif; ">The problem is at the SP side since i just have one physical instance of SP with Logical SP used to map different Applications.</span></div>
<div><span class="Apple-style-span" style="font-family: arial, sans-serif; "><br></span></div><div><span class="Apple-style-span" style="font-family: arial, sans-serif; ">The first <LogoutRequest> to the SP is looking for all the SP session for that user and IDP Entity ID and clearing them, even those of the other Logical SPs.</span></div>
<div><span class="Apple-style-span" style="font-family: arial, sans-serif; "><br></span></div><div><span class="Apple-style-span" style="font-family: arial, sans-serif; ">I can even see an error for this is the shibd log.</span></div>
<div><span class="Apple-style-span" style="font-family: arial, sans-serif; "><br></span></div><div>2011-10-20 04:12:10 DEBUG OpenSAML.MessageDecoder.SAML2 [4]: extracting issuer from SAML 2.0 protocol message</div><div>2011-10-20 04:12:10 DEBUG OpenSAML.MessageDecoder.SAML2 [4]: message from (<b><IDP_ENTITY_ID></b>)</div>
<div>2011-10-20 04:12:10 DEBUG OpenSAML.MessageDecoder.SAML2 [4]: searching metadata for message issuer...</div><div>2011-10-20 04:12:10 DEBUG XMLTooling.StorageService [4]: inserted record (_26d5f05f5f0843950e4b10ee22308f9a) in context (MessageFlow) with expiration (1319064408)</div>
<div>2011-10-20 04:12:10 DEBUG Shibboleth.SessionCache [4]: searching for session (_c6ea50b2d459cc78b1cbb07dcb94f01b)</div><div>2011-10-20 04:12:10 DEBUG Shibboleth.SessionCache [4]: reconstituting session and checking validity</div>
<div>2011-10-20 04:12:10 INFO Shibboleth.SessionCache [4]: request to logout sessions from (<b><IDP_ENTITY_ID></b>) for (<b><USER></b>)</div><div>2011-10-20 04:12:10 DEBUG Shibboleth.SessionCache [4]: searching for session (_cae78322e4c5fc8069e3599c31c8943c)</div>
<div>2011-10-20 04:12:10 DEBUG Shibboleth.SessionCache [4]: reconstituting session and checking validity</div><div>2011-10-20 04:12:10 ERROR Shibboleth.SessionCache [4]: an application (<b><Application_ID></b>) tried to access another application's session</div>
<div><br></div><div><br></div><div>Although, this request gets a Suceess response to the IDP.</div><div><br></div><div>The subsequent <span class="Apple-style-span" style="font-family: arial, sans-serif; "><LogoutRequest> hits</span> for the other Logical SPs fail since their sessions have already been removed.</div>
<div><br></div><div>Kindly suggest if this is a bug or some other issue or incompatibility between the Hungarian SLO and Shibboleth SP.</div><div><br></div><div>Note: I am using my User ID <USER> as the NameID.Not sure if this is the cause of the problem.</div>
<div><span class="Apple-style-span" style="font-family: arial, sans-serif; "> </span></div>