<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Courier New";
mso-fareast-language:EN-GB;}
.MsoChpDefault
{mso-style-type:export-only;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-GB link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>I’ve a test environment with an IdP (non-Shibboleth) that has basic front channel SLO functionality.<o:p></o:p></p><p class=MsoNormal>I’m testing it with two Shibboleth SP servers, both on 2.5.1. One is Centos 6.3 the other is Windows 2012. Both are fresh out of the box Shibboleth SP installs.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The IdP sends singed Logout requests to both SPs via /Shibboleth.sso/SLO/POST<o:p></o:p></p><p class=MsoNormal>It’s set with a NameID in the Logout Request but no session index; so it should remove all sessions for that NameID (which in this case is a PersistentID)<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The Windows server works perfectly and sends Success message back to the IdP correctly.<o:p></o:p></p><p class=MsoNormal><samlp:Status><o:p></o:p></p><p class=MsoNormal> <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/><o:p></o:p></p><p class=MsoNormal></samlp:Status><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>However the Linux server always responds:<o:p></o:p></p><p class=MsoNormal><samlp:Status><o:p></o:p></p><p class=MsoNormal> <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Requester"><o:p></o:p></p><p class=MsoNormal> <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:RequestDenied"/><o:p></o:p></p><p class=MsoNormal> </samlp:StatusCode><o:p></o:p></p><p class=MsoNormal> <samlp:StatusMessage>Error processing request.</samlp:StatusMessage><o:p></o:p></p><p class=MsoNormal></samlp:Status><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>On both servers you get the following debug lines: <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>DEBUG OpenSAML.MessageDecoder.SAML2 [8]: message from (http://IDP)<o:p></o:p></p><p class=MsoNormal>DEBUG OpenSAML.MessageDecoder.SAML2 [8]: searching metadata for message issuer...<o:p></o:p></p><p class=MsoNormal>DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [8]: evaluating message flow policy (replay checking on, expiration 60)<o:p></o:p></p><p class=MsoNormal>DEBUG XMLTooling.StorageService [8]: inserted record (_941e612d-1d51-4f0d-8c60-9e0d04b51084) in context (MessageFlow) with expiration (1361448649)<o:p></o:p></p><p class=MsoNormal>DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [8]: validating signature profile<o:p></o:p></p><p class=MsoNormal>DEBUG XMLTooling.TrustEngine.ExplicitKey [8]: attempting to validate signature with the peer's credentials<o:p></o:p></p><p class=MsoNormal>DEBUG XMLTooling.TrustEngine.ExplicitKey [8]: signature validated with credential<o:p></o:p></p><p class=MsoNormal>DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [8]: signature verified against message issuer<o:p></o:p></p><p class=MsoNormal>DEBUG Shibboleth.SessionCache [8]: searching for session (_........................)<o:p></o:p></p><p class=MsoNormal>DEBUG Shibboleth.SessionCache [8]: reconstituting session and checking validity<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>But when it’s working correctly on the windows server we also get the following afterwards: <o:p></o:p></p><p class=MsoNormal>INFO Shibboleth.SessionCache [2]: request to logout sessions from (http://IDP) for (HASH=)<o:p></o:p></p><p class=MsoNormal>DEBUG XMLTooling.StorageService [2]: inserted record (HASH=) in context (Logout) with expiration (1361448323)<o:p></o:p></p><p class=MsoNormal>DEBUG Shibboleth.SessionCache [2]: searching for session (_..........)<o:p></o:p></p><p class=MsoNormal>DEBUG Shibboleth.SessionCache [2]: reconstituting session and checking validity<o:p></o:p></p><p class=MsoNormal>DEBUG XMLTooling.StorageService [2]: deleted record (HASH=) in context (NameID)<o:p></o:p></p><p class=MsoNormal>DEBUG Shibboleth.Logout.SAML2 [2]: session cache returned 1 sessions bound to NameID in logout request<o:p></o:p></p><p class=MsoNormal>INFO Shibboleth.SessionCache [2]: removed session (_..........)<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>On the Linux server the next thing it does is build the SAML Response with the error message.<o:p></o:p></p><p class=MsoNormal>DEBUG OpenSAML.MessageEncoder.SAML2Redirect [8]: validating input<o:p></o:p></p><p class=MsoNormal>DEBUG OpenSAML.MessageEncoder.SAML2Redirect [8]: marshalling, deflating, base64-encoding the message<o:p></o:p></p><p class=MsoNormal>DEBUG OpenSAML.MessageEncoder.SAML2Redirect [8]: marshalled message:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I’ve got logging set to DEBUG but I can’t see any interesting entries on the failing SP. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I’ve confirmed in both cases the persistent NameID being sent in the Logout request matches the one originally sent when the user authenticated.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Is there any other debugging I can enable to see why it’s not processing on the Linux server?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Paul<o:p></o:p></p></div><p style="font-size: 6px; font-family: Verdana, Arial, sans-serif">_________________________________________________________________________________________________________________________________________</p>
<table width="550" border="0" cellspacing="0" cellpadding="0" style="margin-top:12px; margin-bottom:0px">
<tr><td width="93"><img src="http://www.rm.com/_rmvirtual/media/images/RM-Unify-image-Jan13.jpg" width="165" height="116" alt="RM Unify" /></td><td width="457" valign="top"><p style="font-size: 12px; font-family: Verdana, Arial, sans-serif">RM Unify is your Launch Pad to the Cloud - a single sign-on system, Application Library and Management Console designed specifically for education.</p>
<p style="font-size: 12px; font-family: Verdana, Arial, sans-serif"><strong>RM Unify will be available in March 2013</strong> - sign up today to be amongst the first to join the single sign-on revolution!<br>
<a href="https://www.rm.com/rmunify">Find out more or sign up today »</a></p></td></tr></table>
<p style="font-size: 6px; font-family: Verdana, Arial, sans-serif">_________________________________________________________________________________________________________________________________________</p>
<p style="font-size: 12px; font-family: Verdana, Arial, sans-serif; color:#006600; margin-bottom:15px;">P.S. Think Green - don't print this email unless you really need to.</p>
<!--[if gte mso 9]><xml>
<mso:CustomDocumentProperties>
<mso:ContentType msdt:dt="string">Document</mso:ContentType>
</mso:CustomDocumentProperties>
</xml><![endif]-->
<title></title>
<table border="0" cellspacing="0" cellpadding="0" width="550">
<tr>
<td width="144" valign="top"><p><img width="127" height="107" src="http://www.rm.com/_RMVirtual/media/images/rm_education_email_signature_logo.gif" /></p></td>
<td width="457" valign="top"><p><font face="Verdana" size="2" color="#999999">This message is confidential. You should not copy it or disclose its contents to anyone. You may use and apply the information only for the intended purpose. Internet communications are not secure and therefore RM Education does not accept legal responsibility for the contents of this message. Any views or opinions presented are only those of the author and not those of RM Education. If this email has come to you in error please delete it and any attachments. Please note that RM Education may intercept incoming and outgoing email communications. <br />
<br />
RM Education Ltd is a company registered in England and Wales, Company Reg. No: 01148594; Registered Office: New Mill House, 183 Milton Park, Abingdon, OXON OX14 4SE; VAT No: 630 8236 56 </p></td>
</tr>
</table></body></html>