<div dir="ltr"><div>
<div><div><div><div><div>Hello,<br><br></div><div>I am using Shibboleth 3.3.2. JDK 8. And testing on Firefox 58.0.2<br><br></div>I
am facing 2 problems that may be linked. The logout 'SAML Logout' is
not working : it goes on the page where SP are logged out, but the icons
in front of the SPs never goes green.<br></div>The second problem is that sessions are not retrieved between 2 logins attempted. Here is the test i do:<br></div>- Go to the SP that redirects to Shibboleth login page<br></div>- Log in, and Shibboleth redirect to the SP via the client-storage/client-storage-<wbr>write.vm page. I saw it briefly, and i can confirm because i see in the browser local storage : shib_idp_session_ss.<br></div>- I close the browser <br clear="all"><div><div><div><div><div><div>- I reopen it and go to the SP. <br></div><div>- It redirects to the Idp login page without retrieving the older session.<br><br>
--------------------
<br></div><div>I see the browser is redirected to /client-storage/client-storage<wbr>-read.vm, template because i remove the <body onload="doLoad()"> and put a button :<br><button onclick="doLoad()">Load stored session</button><br></div><div>- A request is send to <a href="https://localhost/idp/profile/SAML2/POST/SSO;jsessionid=23F5A89297C2949B63A6272AD436DC07?execution=e1s1" target="_blank">https://localhost/idp/profile/<wbr>SAML2/POST/SSO;jsessionid=<wbr>23F5A89297C2949B63A6272AD436DC<wbr>07?execution=e1s1</a><br></div><div>With the following parameters :<br>_eventId_proceed: <br>shib_idp_ls_exception.shib_<wbr>idp_persistent_ss: <br>shib_idp_ls_exception.shib_<wbr>idp_session_ss: <br>shib_idp_ls_success.shib_idp_<wbr>persistent_ss: true<br>shib_idp_ls_success.shib_idp_<wbr>session_ss: true<br>shib_idp_ls_supported: true<br>shib_idp_ls_value.shib_idp_<wbr>persistent_ss: AAdzZWNyZXQxXTJAwO6qpdbaEa3iu5<wbr>hNQ989Exr5i3HBeOXzhX0OSvOn680L<wbr>f0tn73MWLc1vqLYgCglkFHq4IYDMCO<wbr>LyYPFlt6xQkFo70LbSmdChHuoV7vFs<wbr>RVBwBxlOpxRatrtIRTAwmYOuzg7fcd<wbr>/xomLQlWHPUHlA29gqSfs5J+<wbr>TnuvR4mb5rV/W+<wbr>1nr6k5IRGzFwW2gBa9fDqIAdf2WIVX<wbr>G+<wbr>qYlEhwefNou2yIpRIeRekSf0GxLNAh<wbr>QG+<wbr>4CNruvTMpT0DgvnxQrGG09c04d20OP<wbr>9s/<wbr>699yoZfhUWlHJN15D9wVuMIfDzMHpr<wbr>R2DqxHfzm3EysqrSb91FMwtLzMTc7a<wbr>3fNm5jG/<wbr>RdSWKtOXK1Bhj9lG95NWrxfCk3ngtN<wbr>piqODR5NXC+<wbr>5sFYIXtaK0z89J7fBGozOkuSV3Snnf<wbr>h0nKMY44yPAnCKxITUPfroZ5EdLwEh<wbr>E8fqbVTDobyYjSG/M5wdIY+<wbr>7qY4chDP+chUwWdCqvh9EjqyIU+<wbr>7FgQWUH…<wbr>wg9yfUrkqQphjHgHVEkllnILm2Pa4/<wbr>17VkEK3CtNRcvXQXINz77N0aaJtPPr<wbr>UemtvMUXn6YmWL9pldrqmeiWa3K0Lf<wbr>MAIL+<wbr>vK5dI1ksC9kDINGDlH2TQfrqtLDpFl<wbr>FBnn1DEg+eHBUXUSvyMw/<wbr>OkBJDHuMHtnjdWiUCD8YVBmWAtD15v<wbr>JNIOKpDpthkSkbbPZyKZMNU07ag+<wbr>Iafvxii9JcjqSRQAljAKkpXQXeh/<wbr>ZVeSpjVTmVTrXQrmKuY9vEF46azkQ5<wbr>EVfOf/nvgdq+<wbr>mTvNC3nINSlQNtfCWAJ/W2kLC3n8q+<wbr>wuolf8kMgzfRVIxjxPrVwSn2gDFYjd<wbr>cLUpsC9N3otzzF7D/<wbr>ljvSSPiiw6sd7es9Ew1TWSrQ1XVghc<wbr>TDz683jwwZn4AZXLkN7silkAmgd9EJ<wbr>8eECyJbDMJ9QsaFCPZx1nrfSLE9NlR<wbr>IaYIzG/3tiJFK+<wbr>z5qoVmxppMHTSelTI7K0Wpn77GIMJc<wbr>Ck5nE0A9W4B9Rucdx6wFFUhTk=<br>shib_idp_ls_value.shib_idp_<wbr>session_ss:<br><br></div><div>As i see
shib_idp_persistent_ss
is not stored the first time in
client-storage-write.vm, may be that is the problem ?<br></div><div><br>
<br>--------------------
<br></div><div></div><div>Here are the idp.properties details. I configured it this way to use the 'SAML Logout' as in <a href="https://wiki.shibboleth.net/confluence/display/IDP30/LogoutConfiguration" target="_blank">https://wiki.shibboleth.net/<wbr>confluence/display/IDP30/<wbr>LogoutConfiguration</a>. And i put
idp.session.maskStorageFailure = false, wishing to have more debug info but it does not give me what i expected.<br><br>idp.additionalProperties=
/conf/ldap.properties, /conf/saml-nameid.properties,
/conf/services.properties, /conf/authn/duo.properties<br><br>idp.entityID= <a href="https://localhost:443/idp/shibboleth" target="_blank">https://localhost:443/idp/<wbr>shibboleth</a><br><br>idp.scope= localhost<br><br>idp.sealer.storeResource= %{idp.home}/credentials/<wbr>sealer.jks<br>idp.sealer.versionResource= %{idp.home}/credentials/<wbr>sealer.kver<br>idp.sealer.storePassword= xxxxx (removed for safety)<br>idp.sealer.keyPassword= xxxxx (removed for safety)<br><br>idp.signing.key= %{idp.home}/credentials/idp-<wbr>signing.key<br>idp.signing.cert= %{idp.home}/credentials/idp-<wbr>signing.crt<br>idp.encryption.key= %{idp.home}/credentials/idp-<wbr>encryption.key<br>idp.encryption.cert= %{idp.home}/credentials/idp-<wbr>encryption.crt<br><br>idp.storage.htmlLocalStorage = true<br><br>idp.session.StorageService = shibboleth.<wbr>ClientPersistentStorageService<br><br>idp.session.maskStorageFailure = false<br>idp.session.trackSPSessions = true<br>idp.session.<wbr>secondaryServiceIndex = true<br><br>idp.authn.flows= Password<br><br>idp.logout.authenticated = true<br><br>idp.ui.fallbackLanguages= en,fr,de<br><br>--------------------<br><br></div><div>I have lots of server logs because i put every logger in DEBUG. I can give more logs if needed. Here are an extract of the ones just after clicking on the 'Load stored session' button :<br><br>2018-03-06 14:40:01,755 - DEBUG [org.springframework.web.servlet.DispatcherServlet:865] - DispatcherServlet with name 'idp' processing POST request for [/idp/profile/SAML2/POST/SSO;jsessionid=A17C5D1A983E976538092F60C17D0DE8]<br>2018-03-06 14:40:01,755 - DEBUG [org.springframework.webflow.mvc.servlet.FlowHandlerMapping:108] - Mapping request with URI '/idp/profile/SAML2/POST/SSO;jsessionid=A17C5D1A983E976538092F60C17D0DE8' to flow with id 'SAML2/POST/SSO'<br>2018-03-06 14:40:01,756 - DEBUG [org.springframework.webflow.executor.FlowExecutorImpl:161] - Resuming flow execution with key 'e1s1<br>2018-03-06 14:40:01,756 - DEBUG [org.springframework.webflow.conversation.impl.SessionBindingConversationManager:75] - Locking conversation 1<br>2018-03-06 14:40:01,756 - DEBUG [org.springframework.webflow.execution.repository.impl.DefaultFlowExecutionRepository:106] - Getting flow execution with key 'e1s1'<br>2018-03-06 14:40:01,756 - DEBUG [org.springframework.webflow.definition.registry.FlowDefinitionRegistryImpl:58] - Getting FlowDefinition with id 'SAML2/POST/SSO'<br>2018-03-06 14:40:01,756 - DEBUG [org.springframework.webflow.definition.registry.FlowDefinitionRegistryImpl:58] - Getting FlowDefinition with id 'client-storage/read'<br>2018-03-06 14:40:01,756 - DEBUG [org.springframework.webflow.execution.factory.ConditionalFlowExecutionListenerLoader:85] - Loaded [1] of possible 1 listeners for this execution request for flow 'SAML2/POST/SSO', the listeners to attach are list[net.shibboleth.idp.profile.support.ProfileRequestContextFlowExecutionListener@1338a5f5]<br>2018-03-06 14:40:01,756 - DEBUG [org.springframework.webflow.engine.impl.FlowExecutionImpl:250] - Resuming in org.springframework.webflow.mvc.servlet.MvcExternalContext@2a92f85b<br>2018-03-06 14:40:01,757 - DEBUG [org.springframework.webflow.mvc.view.AbstractMvcView:224] - Processing user event 'proceed'<br>2018-03-06 14:40:01,757 - DEBUG [org.springframework.webflow.mvc.view.AbstractMvcView:246] - No model to bind to; done processing user event<br>2018-03-06 14:40:01,757 - DEBUG [org.springframework.webflow.engine.ViewState:229] - Event 'proceed' returned from view [ServletMvcView@25a61ea4 view = org.springframework.web.servlet.view.velocity.VelocityView: name '/client-storage/client-storage-read'; URL [/client-storage/client-storage-read.vm]]<br>2018-03-06 14:40:01,757 - DEBUG [org.springframework.webflow.engine.Transition:214] - Executing [Transition@1543535e on = proceed, to = LoadClientStorageServices]<br>2018-03-06 14:40:01,757 - DEBUG [org.springframework.webflow.engine.Transition:222] - Exiting state 'LocalStorageRead'<br>2018-03-06 14:40:01,758 - DEBUG [org.springframework.webflow.engine.ActionState:189] - Entering state 'LoadClientStorageServices' of flow 'client-storage/read'<br>2018-03-06 14:40:01,758 - DEBUG [org.springframework.webflow.execution.ActionExecutor:49] - Executing [EvaluateAction@5041df92 expression = LoadClientStorageServices, resultExpression = [null]]<br>2018-03-06 14:40:01,758 - DEBUG [org.springframework.webflow.execution.AnnotatedAction:142] - Putting action execution attributes map[[empty]]<br>2018-03-06 14:40:01,758 - DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:448] - Creating instance of bean 'LoadClientStorageServices'<br>2018-03-06 14:40:01,758 - DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:251] - Returning cached instance of singleton bean 'shibboleth.HttpServletRequest'<br>2018-03-06 14:40:01,792 - DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:251] - Returning cached instance of singleton bean 'shibboleth.ClientStorageServices'<br>2018-03-06 14:40:01,793 - DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:1678] - Invoking init method 'initialize' on bean with name 'LoadClientStorageServices'<br>2018-03-06 14:40:01,793 - DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:484] - Finished creating instance of bean 'LoadClientStorageServices'<br>2018-03-06 14:40:01,793 - DEBUG [org.springframework.webflow.execution.ActionExecutor:49] - Executing net.shibboleth.idp.profile.impl.WebFlowProfileActionAdaptor@617f2bd0<br>2018-03-06 14:40:01,797 - DEBUG [org.springframework.webflow.execution.ActionExecutor:53] - Finished executing net.shibboleth.idp.profile.impl.WebFlowProfileActionAdaptor@617f2bd0; result = null<br><br></div></div></div></div></div></div>
Thank you<br><br></div>Thomas<br><div><p style="margin-bottom:3pt;background:white none repeat scroll 0% 0%"><a href="http://www.iobeya.com/" target="_blank"><span style="font-size:9pt;font-family:"Arial",sans-serif;color:black;text-decoration:none"></span></a><span style="color:rgb(34,34,34)"></span></p><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><p></p><span style="font-family:Arial,Helvetica,sans-serif;font-size:medium"></span></div></div></div></div></div></div></div></div></div></div></div></div></div>
</div></div>