<div dir="ltr">Hello,<br><br>I have just ran into the issue, that with the same<br>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress<br>if the user logs in then cannot log out because of getting<br>urn:oasis:names:tc:SAML:2.0:status:UnknownPrincipal<br>
status message.<br><br>This is clearly because of the<br><br><a href="http://svn.shibboleth.net/view/java-shib-idp2/tags/2.4.0/src/main/java/edu/internet2/middleware/shibboleth/idp/profile/saml2/SLOProfileHandler.java?revision=3172&view=markup">http://svn.shibboleth.net/view/java-shib-idp2/tags/2.4.0/src/main/java/edu/internet2/middleware/shibboleth/idp/profile/saml2/SLOProfileHandler.java?revision=3172&view=markup</a><br>
<br>255 // Get session corresponding to NameID. This is limited to one session, which means<br>256 // we can't know if more than one might have been issued for a particular NameID.<br>257 SessionManager<Session> sessionManager = getSessionManager();<br>
258<br>String nameIDIndex = getSessionIndexFromNameID(requestContext.getSubjectNameIdentifier());<br>259 log.debug("Querying SessionManager based on NameID '{}'", nameIDIndex);<br>260 Session indexedSession = sessionManager.getSession(nameIDIndex);<br>
<br>My question, how to remediate it. We can only use emailAddress at this time (and SAML standard), and I believe this use case is quite typical. I also wonder why not having eg. JSESSIONID also used as a key with the NameID?<br>
<br>Thanks,<br><br>Tamas<br><br>VWOL<br>Tamas SZERB <<a href="mailto:toma@rulez.org">toma@rulez.org</a>></div>