<div dir="ltr">Hi,<div><br></div><div>Trying to get the new logout support working, and running into an issue. When I request a logout from my SP it sends me back to the correct handler on the IdP. The request comes in with the aslo:Asynchronous extension. The IdP appears in the logs to perform the logout and indeed the session is dead:</div>
<div><br></div><div>18:31:15.437 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:128] - Looking up relying party configuration for <a href="https://shib-sp.uchicago.edu/shibboleth">https://shib-sp.uchicago.edu/shibboleth</a></div>
<div>18:31:15.437 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:134] - No custom relying party configuration found for <a href="https://shib-sp.uchicago.edu/shibboleth">https://shib-sp.uchicago.edu/shibboleth</a>, looking up configuration based on metadata groups.</div>
<div>18:31:15.437 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:157] - No custom or group-based relying party configuration found for <a href="https://shib-sp.uchicago.edu/shibboleth">https://shib-sp.uchicago.edu/shibboleth</a>. Using default relying party configuration.</div>
<div>18:31:15.440 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:487] - No response requested, so skipping endpoint selection.</div><div>18:31:15.440 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:259] - Querying SessionManager based on NameID '_062271bd3413d9c85c1240f78d08af5e|urn:oasis:names:tc:SAML:2.0:nameid-format:transient|<a href="https://shib-sandbox.uchicago.edu/idp/shibboleth|https://shib-sp.uchicago.edu/shibboleth">https://shib-sandbox.uchicago.edu/idp/shibboleth|https://shib-sp.uchicago.edu/shibboleth</a>'</div>
<div>18:31:15.456 - INFO [edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:178] - Invalidating session identified by LogoutRequest: eb1b0b0d0f237ea17070d6cf3aa135a00b14dbba34f19d4490236480c3495540</div>
<div>18:31:15.490 - INFO [Shibboleth-Audit:1028] - 20130510T233115Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_ae42a616bbddb0385a84eb0b319105c1|<a href="https://shib-sp.uchicago.edu/shibboleth|urn:mace:shibboleth:2.0:profiles:saml2:logout|https://shib-sandbox.uchicago.edu/idp/shibboleth|null|null|davel|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||_062271bd3413d9c85c1240f78d08af5e||">https://shib-sp.uchicago.edu/shibboleth|urn:mace:shibboleth:2.0:profiles:saml2:logout|https://shib-sandbox.uchicago.edu/idp/shibboleth|null|null|davel|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||_062271bd3413d9c85c1240f78d08af5e||</a></div>
<div><br></div><div>However, it then dumps me at error.jsp with no discernable error message instead of logout.jsp.</div><div><br></div><div style>If I have an currently active session and hit the local logout handler, I get the same thing:</div>
<div style><br></div><div>18:40:56.097 - INFO [Shibboleth-Access:73] - 20130510T234056Z|205.208.122.92|shib-sandbox.uchicago.edu:443|/profile/Logout|</div><div>18:40:56.097 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:86] - shibboleth.HandlerManager: Looking up profile handler for request path: /Logout</div>
<div>18:40:56.098 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:97] - shibboleth.HandlerManager: Located profile handler of the following type for the request path: edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler</div>
<div>18:40:56.098 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:151] - Processing logout request</div><div style>18:40:56.098 - INFO [edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:184] - Invalidating session identified from client request: 5cb8ad2f8c55980dc2bdcffbdbf2512a34e5e43ad9987f248c56b190baeff3a7 <br>
</div><div style><br></div><div style>However, if I do NOT have an active session and hit the local logout handler I get the expected behavior.</div><div style><br></div><div style>There are 2 differences between our setup and stock. First we're using the Memcache storage service. Second, we have a custom login handler for dealing with Assurance. This behavior happens whether we use the stock UsernamePassword Login Handler or our Assurance Login Handler. </div>
<div><div><br></div><div style>Thoughts? Ideas?</div><div style><br>Dave</div><div><br></div>-- <br>David Langenberg<div>Identity & Access Management</div><div>The University of Chicago</div>
</div></div>