<html><head></head><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:13px"><div id="yui_3_16_0_1_1458135352541_30419" dir="ltr">I have two servers but I thought for clustering you needed to use <font id="yui_3_16_0_1_1458135352541_30693" face="HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif"><code id="yui_3_16_0_1_1458135352541_30448" class="java plain">idp.session.StorageService = shibboleth.MemcachedStorageService</code></font></div><div id="yui_3_16_0_1_1458135352541_30583" dir="ltr"><br><font face="HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif"><code id="yui_3_16_0_1_1458135352541_30448" class="java plain"></code></font></div><div id="yui_3_16_0_1_1458135352541_30582" dir="ltr"><font id="yui_3_16_0_1_1458135352541_30696" face="HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif"><code id="yui_3_16_0_1_1458135352541_30448" class="java plain"><font id="yui_3_16_0_1_1458135352541_30695" size="2"><font id="yui_3_16_0_1_1458135352541_30694" face="HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif">According to the StorageConfiguration web page the only other serverside config is </font></font></code></font>idp.session.StorageService = shibboleth.StorageService</div><div id="yui_3_16_0_1_1458135352541_30418"><br><span></span></div><div dir="ltr" id="yui_3_16_0_1_1458135352541_30845"><span id="yui_3_16_0_1_1458135352541_31014">I'd thought the difference was memcached allowed clustering which provides consistency through restarts and StorageService couldn't survive a restart. Given that I'd need to recompile my IDP to allow memcached I wanted to get it working on local memory before going through the effort of rebuilding for memcached.</span></div><div id="yui_3_16_0_1_1458135352541_30447"><div id="yui_3_16_0_1_1458135352541_31061"> </div><div id="yui_3_16_0_1_1458135352541_37309">With respect to NameID I had to change NameID from transient to email to satisfy Service Now, the only attribute they use is NameID.</div><div id="yui_3_16_0_1_1458135352541_39059"><br></div><div id="yui_3_16_0_1_1458135352541_39144" dir="ltr">I do have a thought though about NameID, one of our developers created an attribute in attribute-filters.xml called NameID, I wonder if it's causing confusion.</div><div id="yui_3_16_0_1_1458135352541_39145" dir="ltr"><br></div><div id="yui_3_16_0_1_1458135352541_39146" dir="ltr">Regards</div><div id="yui_3_16_0_1_1458135352541_39147" dir="ltr">-Bob<br></div></div><div id="yui_3_16_0_1_1458135352541_30422" class="signature"><div id="yui_3_16_0_1_1458135352541_30421">--<br>Bob Lamothe<br>robert_lamothe@yahoo.com<br>KB1BOB<br>603-918-6336<br><br></div></div> <div class="qtdSeparateBR"><br><br></div><div style="display: block;" class="yahoo_quoted"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 13px;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div dir="ltr"><font face="Arial" size="2"> On Wednesday, March 16, 2016 10:50 AM, "Cantor, Scott" <cantor.2@osu.edu> wrote:<br></font></div> <br><br> <div class="y_msg_container">On 3/16/16, 10:40 AM, "users on behalf of Robert Lamothe" <<a shape="rect" ymailto="mailto:users-bounces@shibboleth.net" href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> on behalf of <a shape="rect" ymailto="mailto:robert_lamothe@yahoo.com" href="mailto:robert_lamothe@yahoo.com">robert_lamothe@yahoo.com</a>> wrote:<br clear="none"><br clear="none"><br clear="none"><br clear="none">>Ok, so, idp.session.trackSPSessions and idp.session.secondaryServiceIndex properties were already set to true, but service side storage was not, so I set idp.session.StorageService = shibboleth.StorageService.<br clear="none"><br clear="none">That has significant clustering implications. Is this a one server system? If not, that won't work.<br clear="none"><br clear="none">> <br clear="none">> On the SP I'm getting the same error, but on the IDP I'm now getting:<br clear="none">><br clear="none">>2016-03-16 10:35:28,450 - INFO [net.shibboleth.idp.saml.saml2.profile.impl.ProcessLogoutRequest:315] - Profile Action ProcessLogoutRequest: No active session(s) found matching LogoutRequest<br clear="none"><br clear="none">Well, the request S-N issued did not correspond to a session in the cache, generally indicating a NameID mismatch of some sort. You can turn up logging and you'll what NameID was issued to S-N and then what NameID it sent back in the LogoutRequest, that would be the starting point I guess. They have to match or the SAML protocol requires that it fail.<br clear="none"><br clear="none">If that's all foreign, then you can read the SAML standard's SingleLogout protocol section, which is fairly short, and get a sense of how it works to understand how it can fail.<div class="yqt4961073839" id="yqtfd70713"><br clear="none"><br clear="none">-- Scott<br clear="none"><br clear="none">-- <br clear="none">To unsubscribe from this list send an email to <a shape="rect" ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br clear="none"></div><br><br></div> </div> </div> </div></div></body></html>