<div dir="ltr">I believe that also impacts the<br>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent<br>and<br>urn:oasis:names:tc:SAML:2.0:nameid-format:transient<br>kind of NameIDs, and the transient can be "fixed" to set the TTL to quite low, so I'd consider this a bug.<br>
<br>Cheers,<br><br>Tamas<code><br></code></div><div class="gmail_extra"><br clear="all"><div>VWOL<br>Tamas SZERB <<a href="mailto:toma@rulez.org">toma@rulez.org</a>></div>
<br><br><div class="gmail_quote">On Thu, Jul 3, 2014 at 3:35 PM, Szerb, Tamas <span dir="ltr"><<a href="mailto:toma@rulez.org" target="_blank">toma@rulez.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">Hello,<br><br>I have just ran into the issue, that with the same<br>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress<br>if the user logs in then cannot log out because of getting<br>urn:oasis:names:tc:SAML:2.0:status:UnknownPrincipal<br>
status message.<br><br>This is clearly because of the<br><br><a href="http://svn.shibboleth.net/view/java-shib-idp2/tags/2.4.0/src/main/java/edu/internet2/middleware/shibboleth/idp/profile/saml2/SLOProfileHandler.java?revision=3172&view=markup" target="_blank">http://svn.shibboleth.net/view/java-shib-idp2/tags/2.4.0/src/main/java/edu/internet2/middleware/shibboleth/idp/profile/saml2/SLOProfileHandler.java?revision=3172&view=markup</a><br>
<br>255 // Get session corresponding to NameID. This is limited to one session, which means<br>256 // we can't know if more than one might have been issued for a particular NameID.<br>257 SessionManager<Session> sessionManager = getSessionManager();<br>
258<br>String nameIDIndex = getSessionIndexFromNameID(requestContext.getSubjectNameIdentifier());<br>259 log.debug("Querying SessionManager based on NameID '{}'", nameIDIndex);<br>260 Session indexedSession = sessionManager.getSession(nameIDIndex);<br>
<br>My question, how to remediate it. We can only use emailAddress at this time (and SAML standard), and I believe this use case is quite typical. I also wonder why not having eg. JSESSIONID also used as a key with the NameID?<br>
<br>Thanks,<br><br>Tamas<br><br>VWOL<br>Tamas SZERB <<a href="mailto:toma@rulez.org" target="_blank">toma@rulez.org</a>></div>
</blockquote></div><br></div>