<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.E-MailFormatvorlage17
{mso-style-type:personal-compose;
font-family:"Arial","sans-serif";
color:windowtext;
font-weight:normal;
font-style:normal;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="DE" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Arial","sans-serif"">Hello,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Arial","sans-serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Arial","sans-serif"">since one year we’re running the Shibboleth IdP (2.4.0). The SP part is an own implementation with OpenSaml (2.6.0).<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Arial","sans-serif"">Normally every thing is working fine and we don’t have any problems, but sometimes the logout fails (I know that the SAML logout process isn’t fully implemented, but for our needs
the logout of the IdP session is sufficient). And it’s really only sometimes, which makes it hard to reproduce.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Arial","sans-serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Arial","sans-serif"">The cause of the failed logout out, is that the found session hasn’t the same session id as the active session:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Arial","sans-serif"">WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:296] - LogoutRequest referenced a session other than the client's current one.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Arial","sans-serif"">Also if the user logs in and out again (call SP -> redirect to IdP -> has already active session -> PreviousSessionHandler will redirect to SP with valid AuthnResponse), the logout
will fail with the same reason.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Arial","sans-serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Arial","sans-serif"">I already checked the session ids of the AuthnRespone and LogoutRequest and the indexed NameId and the NameId used for querying the session, but they match and they have to match
because otherwise the IdP won’t find an indexed session.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Arial","sans-serif"">I also checked the sources of the IdP to understand the session handling but I didn’t found a scenario, that would produce different session ids…<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Arial","sans-serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Arial","sans-serif"">Testing scenario: login at 2 SPs, logout of both, login at both SPs again and repeat till it fails.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Arial","sans-serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Arial","sans-serif"">Our tester used the IE 10 to produce this failure: Are there any known problems with the IE10?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Arial","sans-serif"">But at the moment I can’t really say, if the problem only occurs with IE10.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Arial","sans-serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Arial","sans-serif"">I also know that you don’t know the self implemented SP, but I don’t think that there’s a problem. Because it runs also with other IdPs (no Shibboleth product) than ours and works
fine.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Arial","sans-serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Arial","sans-serif"">I hope my description of the problem is clear and I didn’t forgot any information..<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Arial","sans-serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Arial","sans-serif"">Thanks for your support!<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Arial","sans-serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Arial","sans-serif"">Patrick Röhrl<o:p></o:p></span></p>
</div>
</body>
</html>