<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif;font-size:12pt"><div><span>Scott,</span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><span> Thanks for your reply.</span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><span><br></span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><span>IdP does have the session for the user identified by NameId; when the SP issues AuthnRequest immediately following
the failed LogoutRequest, the IdP logs says "Existing IdP session available for principal user2".</span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><span>Here "user2" is an user (cn) in LDAP directory.</span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><span><br></span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><span>I have tried "urn:oasis:names:tc:SAML:2.0:nameid-format:transient" and "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" as the NameIdFormat, but in both cases,
LogoutRequest is not processed by IdP even though there is active session.</span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><span><br></span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><span>Here is the idp-process.log:</span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><span><br></span></div><div style="background-color: transparent;">22:01:53.633 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:154] - Processing incoming SAML LogoutRequest</div><div
style="background-color: transparent;">22:01:53.633 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:502] - Decoding message with decoder binding 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'</div><div style="background-color: transparent;">22:01:53.644 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:516] - Decoded request from relying party 'https://inw00003973:8443'</div><div style="background-color: transparent;">22:01:53.645 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:259] - Querying SessionManager based on NameID '_0edf84c284fd5f35a5e2d2e5f9f81bc6|urn:oasis:names:tc:SAML:2.0:nameid-format:transient|https://inw00003973.informatica.com/idp/shibboleth'</div><div style="background-color: transparent;">22:01:53.645 - INFO [edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:266] - LogoutRequest did not reference an active
session.</div><div style="background-color: transparent;">22:01:53.647 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:796] - Encoding response to SAML request 888d5eaa-a478-4f25-9e56-ab9bae6292a5 from relying party https://inw00003973:8443</div><div style="background-color: transparent;">22:01:53.661 - INFO [Shibboleth-Audit:1028] - 20131126T163153Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|888d5eaa-a478-4f25-9e56-ab9bae6292a5|https://inw00003973:8443|urn:mace:shibboleth:2.0:profiles:saml2:logout|https://inw00003973.informatica.com/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_daa6be06c76bce4322ad25421c3c5c07|user2|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||_0edf84c284fd5f35a5e2d2e5f9f81bc6||</div><div style="background-color: transparent;">22:04:30.355 - INFO [Shibboleth-Access:73] -
20131126T163430Z|192.168.1.8|inw00003973.informatica.com:443|/profile/SAML2/Redirect/SSO|</div><div style="background-color: transparent;">22:04:30.355 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:86] - shibboleth.HandlerManager: Looking up profile handler for request path: /SAML2/Redirect/SSO</div><div style="background-color: transparent;">22:04:30.355 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:97] - shibboleth.HandlerManager: Located profile handler of the following type for the request path: edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler</div><div style="background-color: transparent;">22:04:30.355 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:188] - Incoming request does not contain a login context, processing as first leg of request</div><div style="background-color: transparent;">22:04:30.356 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:366] - Decoding message with decoder binding 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'</div><div style="background-color: transparent;">22:04:30.357 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:387] - Decoded request from relying party 'https://inw00003973:8443'</div><div style="background-color: transparent;">22:04:30.357 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:226] - Creating login context and transferring control to authentication engine</div><div style="background-color: transparent;">22:04:30.358 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:240] - Redirecting user to authentication engine at https://inw00003973.informatica.com:443/idp/AuthnEngine</div><div style="background-color: transparent;">22:04:30.361 - DEBUG
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:209] - Processing incoming request</div><div style="background-color: transparent;">22:04:30.361 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:240] - Beginning user authentication process.</div><div style="background-color: transparent;">22:04:30.361 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:244] - Existing IdP session available for principal user2</div><div style="background-color: transparent;">22:04:30.361 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:283] - Filtering configured LoginHandlers: {urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession=edu.internet2.middleware.shibboleth.idp.authn.provider.PreviousSessionLoginHandler@2058e3ec,
urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport=edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginHandler@2bdbab8b}</div><div style="background-color: transparent;">22:04:30.362 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:464] - Selecting appropriate login handler from filtered set {urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession=edu.internet2.middleware.shibboleth.idp.authn.provider.PreviousSessionLoginHandler@2058e3ec, urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport=edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginHandler@2bdbab8b}</div><div style="background-color: transparent;">22:04:30.362 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:467] - Authenticating user with previous session LoginHandler</div><div style="background-color: transparent;">22:04:30.362 - DEBUG
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:478] - Basing previous session authentication on active authentication method urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</div><div style="background-color: transparent;">22:04:30.362 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.PreviousSessionLoginHandler:112] - Using existing IdP session for user2</div><div style="background-color: transparent;">22:04:30.362 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:144] - Returning control to authentication engine</div><div style="background-color: transparent;">22:04:30.362 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:209] - Processing incoming request</div><div style="background-color: transparent;">22:04:30.363 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:514] - Completing user authentication process</div><div
style="background-color: transparent;">22:04:30.363 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:585] - Validating authentication was performed successfully</div><div style="background-color: transparent;">22:04:30.363 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:696] - Updating session information for principal user2</div><div style="background-color: transparent;"><span></span></div><div style="background-color: transparent;">22:04:30.363 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:560] - User user2 authenticated with method urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</div><div><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;">Thanks,</div><div style="color: rgb(0, 0, 0); font-size:
16px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;">Vasu</div> <div style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 12pt;"> <div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;"> <div dir="ltr"> <hr size="1"> <font size="2" face="Arial"> <b><span style="font-weight:bold;">From:</span></b> "Cantor, Scott" <cantor.2@osu.edu><br> <b><span style="font-weight: bold;">To:</span></b> Shib Users <users@shibboleth.net> <br> <b><span style="font-weight: bold;">Sent:</span></b> Tuesday, 26 November 2013 8:20 PM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: LogoutRequest not fulfilled by IdP<br> </font> </div> <div class="y_msg_container"><br>On 11/26/13, 2:04 AM, "vyal2k" <<a shape="rect" ymailto="mailto:vyal2k@yahoo.com"
href="mailto:vyal2k@yahoo.com">vyal2k@yahoo.com</a>> wrote:<div class="yqt3588272666" id="yqtfd45422"><br clear="none"><br clear="none">>Hi,<br clear="none">> I am trying to send a LogoutRequest from SP to IdP, but the request is<br clear="none">>not fulfilled by IdP.<br clear="none">>idp-process.log says "LogoutRequest did not reference an active session."<br clear="none">>even though the LogoutRequest contains sessionIndex from Assertion's<br clear="none">>AuthnStatement.</div><br clear="none"><br clear="none">There's nothing else to tell you. The session cache didn't have a session<br clear="none">matching the NameID. The SessionIndex is not relevant, the IdP doesn't<br clear="none">support that feature.<br clear="none"><br clear="none">-- Scott<br clear="none"><br clear="none"><br clear="none">--<br clear="none">To unsubscribe from this list send an email to <a shape="rect" ymailto="mailto:users-unsubscribe@shibboleth.net"
href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><div class="yqt3588272666" id="yqtfd91169"><br clear="none"></div><br><br></div> </div> </div> </div></body></html>