<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif;font-size:12pt"><div>Hi,</div><div> I am trying to send a LogoutRequest from SP to IdP, but the request is not fulfilled by IdP.</div><div>idp-process.log says "LogoutRequest did not reference an active session." even though the LogoutRequest contains sessionIndex from Assertion's AuthnStatement.</div><div><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;">Here is the LogoutResponse from IdP:</div><div style="background-color: transparent;"><saml2p:LogoutResponse xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://inw00003973:8443/testsp/SSOLogoutServlet" </div><div style="background-color:
transparent;">ID="_e480d271c81a2e861f53b50648f108b7" InResponseTo="ec61ed5a-4532-4da2-922c-ac97423fc0e2" IssueInstant="2013-11-26T06:39:56.754Z" Version="2.0"></div><div style="background-color: transparent;"><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://inw00003973/idp/shibboleth</saml2:Issuer></div><div style="background-color: transparent;"><saml2p:Status><saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Requester"><saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:UnknownPrin</div><div style="background-color: transparent;">cipal"/></saml2p:StatusCode></saml2p:Status></saml2p:LogoutResponse></div><div style="background-color: transparent;"><br></div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial,
'Lucida Grande', sans-serif; font-style: normal;">And here is the LogoutRequest (signature/certificate skipped to conserve space):</div><div style="background-color: transparent;"><saml2p:LogoutRequest xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://inw00003973/idp/profi</div><div style="background-color: transparent;">le/SAML2/Redirect/SLO" ID="ec61ed5a-4532-4da2-922c-ac97423fc0e2" IssueInstant="2013-11-26T06:39:56.607Z" Reason="urn:oasis:names:tc:SAML:2.0:logout:user" Version="2.0"></div><div style="background-color: transparent;"> <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://inw00003973:8443</saml2:Issuer></div><div style="background-color: transparent;"> <saml2:NameID xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">vasu@abc.com</saml2:NameID></div><div style="background-color:
transparent;"> <saml2p:SessionIndex>_67ddd3bc159b233ba89ee1a00a330890</saml2p:SessionIndex></div><div style="background-color: transparent;"></saml2p:LogoutRequest></div><div style="background-color: transparent;"><br></div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-style: normal;">And here is the decrypted Assertion from successful AuthnRequest:</div><div style="background-color: transparent;"><saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="_5f1be83380ec5ffd716fec00477f2491" IssueInstant="2013-</div><div style="background-color: transparent;">11-26T06:39:55.911Z" Version="2.0"><saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://inw00003973/idp/shibboleth</saml2:Issuer></div><div style="background-color:
transparent;"><saml2:Subject><saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" NameQualifier="https://inw00003973/idp/shibboleth"</div><div style="background-color: transparent;"> SPNameQualifier="https://inw00003973:8443">vasu@abc.com</saml2:NameID><saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml2:SubjectConfirmationData Address="192.168.1.8" InResponseTo="49815679-033d-439b</div><div style="background-color: transparent;">-97ad-1ebe85d60568" NotOnOrAfter="2013-11-26T06:44:55.911Z" Recipient="https://inw00003973:8443/testsp/AcsServlet"/></saml2:SubjectConfirmation></saml2:Subject><saml2:Conditions NotBefore="2013-11-26T06:39:55.911Z" NotOnOrAfter="2</div><div style="background-color:
transparent;">013-11-26T06:44:55.911Z"><saml2:AudienceRestriction><saml2:Audience>https://inw00003973:8443</saml2:Audience></saml2:AudienceRestriction></saml2:Conditions><saml2:AuthnStatement AuthnInstant="2013-11-26T06:39:55.894Z" SessionIndex</div><div style="background-color: transparent;">="_67ddd3bc159b233ba89ee1a00a330890"><saml2:SubjectLocality Address="192.168.1.8"/><saml2:AuthnContext><saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef></sam</div><div style="background-color: transparent;">l2:AuthnContext></saml2:AuthnStatement></saml2:Assertion></div><div style="background-color: transparent;"><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style:
normal;">Here is the idp-process.log:</div><div style="background-color: transparent;">12:09:55.927 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:331] - secondarily indexing user session by name identifier</div><div style="background-color: transparent;">12:09:55.927 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:796] - Encoding response to SAML request 49815679-033d-439b-97ad-1ebe85d60568 from relying party https://inw00003973:8443</div><div style="background-color: transparent;">12:09:55.932 - INFO [Shibboleth-Audit:1028] -
20131126T063955Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|49815679-033d-439b-97ad-1ebe85d60568|https://inw00003973:8443|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://inw00003973/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_15a6abe08275ebb79e7ddbec5b820ac1|user2|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||vasu@abc.com||</div><div style="background-color: transparent;">12:09:56.749 - INFO [Shibboleth-Access:73] - 20131126T063956Z|192.168.1.8|inw00003973:443|/profile/SAML2/Redirect/SLO|</div><div style="background-color: transparent;">12:09:56.749 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:86] - shibboleth.HandlerManager: Looking up profile handler for request path: /SAML2/Redirect/SLO</div><div style="background-color: transparent;">12:09:56.749 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:97] - shibboleth.HandlerManager:
Located profile handler of the following type for the request path: edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler</div><div style="background-color: transparent;">12:09:56.749 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:154] - Processing incoming SAML LogoutRequest</div><div style="background-color: transparent;">12:09:56.750 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:502] - Decoding message with decoder binding 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'</div><div style="background-color: transparent;">12:09:56.753 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:516] - Decoded request from relying party 'https://inw00003973:8443'</div><div style="background-color: transparent;">12:09:56.753 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:259] - Querying SessionManager based on
NameID 'vasu@abc.com|urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress'</div><div style="background-color: transparent;">12:09:56.753 - INFO [edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:266] - LogoutRequest did not reference an active session.</div><div style="background-color: transparent;">12:09:56.754 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:796] - Encoding response to SAML request ec61ed5a-4532-4da2-922c-ac97423fc0e2 from relying party https://inw00003973:8443</div><div style="background-color: transparent;">12:09:56.775 - INFO [Shibboleth-Audit:1028] -
20131126T063956Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|ec61ed5a-4532-4da2-922c-ac97423fc0e2|https://inw00003973:8443|urn:mace:shibboleth:2.0:profiles:saml2:logout|https://inw00003973/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_e480d271c81a2e861f53b50648f108b7|user2|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||vasu@abc.com||</div><div><br></div><div>Thanks,</div><div>Vasu</div></div></body></html>