<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style>
</head>
<body class='hmmessage'><div dir='ltr'>
Hi,<br>I am trying to get a front-channel SLO scenario working. I am sending signed SAML 2.0 Logout Request messages to the /Shibboleth.sso/SLO/Redirect endpoint of a Win32 ShibbolethSP 2.4.3 installation, but all I get in return is a SAML 2.0 Response with an error message ("Error processing request.").<br>From the shibd.log it appears that the Logout Request message gets correctly parsed and verified, and then the error response is produced, without any explicit reason.<br><br>Here is the content of the shibd.log.<br>Thanks in advance for any help!<br><br>2011-12-09 17:34:42 DEBUG Shibboleth.Listener [1]: dispatching message (default/SLO/Redirect)<br>2011-12-09 17:34:42 DEBUG OpenSAML.MessageDecoder.SAML2Redirect [1]: validating input<br>2011-12-09 17:34:42 DEBUG OpenSAML.MessageDecoder.SAML2Redirect [1]: decoded SAML message:<br><?xml version="1.0" encoding="UTF-8"?><saml2p:LogoutRequest xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://sp-host/shib-sp-test/protectedUP/Shibboleth.sso/SLO/Redirect" ID="_d15fb2a308418aff404969db545e5a98" IssueInstant="2011-12-09T16:34:42.949Z" Version="2.0"><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">TheIssuer</saml2:Issuer><saml2:NameID xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">_5f87df2146929ba4d4fbd2fef003d403</saml2:NameID></saml2p:LogoutRequest><br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject.Builder [1]: located XMLObjectBuilder for element name: saml2p:LogoutRequest<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: unmarshalling DOM element (saml2p:LogoutRequest)<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: unmarshalling attributes for DOM element (saml2p:LogoutRequest)<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: processing generic attribute<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: processing generic attribute<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: processing generic attribute<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: processing generic attribute<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: found namespace declaration, adding it to the list of namespaces on the XMLObject<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: unmarshalling child nodes of DOM element (saml2p:LogoutRequest)<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject.Builder [1]: located XMLObjectBuilder for element name: saml2:Issuer<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: unmarshalling child element (saml2:Issuer)<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: unmarshalling DOM element (saml2:Issuer)<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: unmarshalling attributes for DOM element (saml2:Issuer)<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: processing generic attribute<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: found namespace declaration, adding it to the list of namespaces on the XMLObject<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: unmarshalling child nodes of DOM element (saml2:Issuer)<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: processing text content at position (0)<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject.Builder [1]: located XMLObjectBuilder for element name: saml2:NameID<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: unmarshalling child element (saml2:NameID)<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: unmarshalling DOM element (saml2:NameID)<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: unmarshalling attributes for DOM element (saml2:NameID)<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: processing generic attribute<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: found namespace declaration, adding it to the list of namespaces on the XMLObject<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: unmarshalling child nodes of DOM element (saml2:NameID)<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: processing text content at position (0)<br>2011-12-09 17:34:42 DEBUG OpenSAML.MessageDecoder.SAML2 [1]: extracting issuer from SAML 2.0 protocol message<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject.Builder [1]: located XMLObjectBuilder for element name: saml2:Issuer<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: unmarshalling DOM element (saml2:Issuer)<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: unmarshalling attributes for DOM element (saml2:Issuer)<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: processing generic attribute<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: found namespace declaration, adding it to the list of namespaces on the XMLObject<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: unmarshalling child nodes of DOM element (saml2:Issuer)<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: processing text content at position (0)<br>2011-12-09 17:34:42 DEBUG OpenSAML.MessageDecoder.SAML2 [1]: message from (TheIssuer)<br>2011-12-09 17:34:42 DEBUG OpenSAML.MessageDecoder.SAML2 [1]: searching metadata for message issuer...<br>2011-12-09 17:34:42 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [1]: evaluating message flow policy (replay checking on, expiration 60)<br>2011-12-09 17:34:42 DEBUG XMLTooling.StorageService [1]: inserted record (_d15fb2a308418aff404969db545e5a98) in context (MessageFlow) with expiration (1323448722)<br>2011-12-09 17:34:42 DEBUG XMLTooling.TrustEngine.ExplicitKey [1]: attempting to validate signature with the peer's credentials<br>2011-12-09 17:34:42 DEBUG XMLTooling.TrustEngine.ExplicitKey [1]: signature validated with public key<br>2011-12-09 17:34:42 DEBUG OpenSAML.SecurityPolicyRule.SimpleSigning [1]: signature verified against message issuer<br>2011-12-09 17:34:42 DEBUG Shibboleth.SessionCache [1]: searching for session (_1d26a69912cdd73f1dc9701be20868de)<br>2011-12-09 17:34:42 DEBUG Shibboleth.SessionCache [1]: reconstituting session and checking validity<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: unmarshalling DOM element (saml2:NameID)<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: unmarshalling attributes for DOM element (saml2:NameID)<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: processing generic attribute<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: processing generic attribute<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: processing generic attribute<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: found namespace declaration, adding it to the list of namespaces on the XMLObject<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: unmarshalling child nodes of DOM element (saml2:NameID)<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: processing text content at position (0)<br>2011-12-09 17:34:42 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]: validating input<br>2011-12-09 17:34:42 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]: marshalling, deflating, base64-encoding the message<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: starting to marshal samlp:LogoutResponse<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: creating root element to marshall<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: marshalling namespace attributes for XMLObject<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: marshalling text and child elements for XMLObject<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: starting to marshalling saml:Issuer<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: creating root element to marshall<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: marshalling namespace attributes for XMLObject<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: marshalling text and child elements for XMLObject<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: caching DOM for XMLObject<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: starting to marshalling samlp:Status<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: creating root element to marshall<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: marshalling namespace attributes for XMLObject<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: marshalling text and child elements for XMLObject<br>2011-12-09 17:34:42 DEBUG XMLTooling.XMLObject [1]: starting to marshalling samlp:StatusCode<br>2011-12-09 17:34:43 DEBUG XMLTooling.XMLObject [1]: creating root element to marshall<br>2011-12-09 17:34:43 DEBUG XMLTooling.XMLObject [1]: marshalling namespace attributes for XMLObject<br>2011-12-09 17:34:43 DEBUG XMLTooling.XMLObject [1]: marshalling text and child elements for XMLObject<br>2011-12-09 17:34:43 DEBUG XMLTooling.XMLObject [1]: starting to marshalling samlp:StatusCode<br>2011-12-09 17:34:43 DEBUG XMLTooling.XMLObject [1]: creating root element to marshall<br>2011-12-09 17:34:43 DEBUG XMLTooling.XMLObject [1]: marshalling namespace attributes for XMLObject<br>2011-12-09 17:34:43 DEBUG XMLTooling.XMLObject [1]: marshalling text and child elements for XMLObject<br>2011-12-09 17:34:43 DEBUG XMLTooling.XMLObject [1]: caching DOM for XMLObject<br>2011-12-09 17:34:43 DEBUG XMLTooling.XMLObject [1]: caching DOM for XMLObject<br>2011-12-09 17:34:43 DEBUG XMLTooling.XMLObject [1]: starting to marshalling samlp:StatusMessage<br>2011-12-09 17:34:43 DEBUG XMLTooling.XMLObject [1]: creating root element to marshall<br>2011-12-09 17:34:43 DEBUG XMLTooling.XMLObject [1]: marshalling namespace attributes for XMLObject<br>2011-12-09 17:34:43 DEBUG XMLTooling.XMLObject [1]: marshalling text and child elements for XMLObject<br>2011-12-09 17:34:43 DEBUG XMLTooling.XMLObject [1]: caching DOM for XMLObject<br>2011-12-09 17:34:43 DEBUG XMLTooling.XMLObject [1]: caching DOM for XMLObject<br>2011-12-09 17:34:43 DEBUG XMLTooling.XMLObject [1]: caching DOM for XMLObject (document is bound)<br>2011-12-09 17:34:43 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]: marshalled message:<br><samlp:LogoutResponse xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://myhost/MySLOApp/Logout" ID="_a62a85412843b509ec9f7c252a9474e7" InResponseTo="_d15fb2a308418aff404969db545e5a98" IssueInstant="2011-12-09T16:34:42Z" Version="2.0"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">TheServiceProvider</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Requester"><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:RequestDenied"/></samlp:StatusCode><samlp:StatusMessage>Error processing request.</samlp:StatusMessage></samlp:Status></samlp:LogoutResponse><br>2011-12-09 17:34:43 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]: signing the message<br>2011-12-09 17:34:43 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]: message encoded, sending redirect to client <br> </div></body>
</html>