<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN">
<html><body>
I have this scenario:<br />-a Shibboleth IDPv4<br />-two SP: SP_A and SP_B<br />(Shibbolet SPv2 with apache)<br /><br />I tested with succes the SLO offered by default by shibboleth idp with the velocity templates.<br /><br />In alternative to the SLO by the default logout.vm we are implementing a managed logout in a custom java servlet.<br /><br />In my java servlet:<br /><br />From the http request I have successfully extracted the object net.shibboleth.idp.session.context.LogoutContext relative to the execution parameter (e.g. 'e1s1',..).<br /><br />From the LogoutContext, and accessing the configuration files in the idp (e.g. metadata file) I recovered all the info I need to build a logout response for the SP.<br /><br />All works fine (with only one SP) and I have a succes logout response sent from the IDP to the SP.<br /><br />When there are more than one SP, I'm trying to build an "IDP initiated logout request" to the other SP.<br /><br />I build a simple logout request, but I get a Logout Response from the SP with the status <br />urn:oasis:names:tc:SAML:2.0:status:RequestDenied, I think my problem is with the NameID:<br /><br /><saml2p:LogoutRequest xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" <br /> Destination="https://SP_B/Shibboleth.sso/SLO/Redirect"<br /> ID="_random_uid"<br /> IssueInstant="2023-01-12T14:49:18.187Z"<br /> Version="2.0"<br /> ><br /> <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://my-idp-name/</saml2:Issuer><br /> <saml:NameID NameQualifier=">????????</" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" >????????</saml:NameID> <br /> <saml2p:SessionIndex>_another_random_uid</saml2p:SessionIndex><br /></saml2p:LogoutRequest><br /><br />I'm trying various combination for the attribute NameQualifier and for the value of NameID.<br /><br />NameQualifier should be the entityid of the idp or the sp?<br /><br />The value of the NameID it's something I can find in some object from:<br /><br />Multimap<String, SPSession> multimap = logoutContext.getSessionMap();<br /><br />?<br /><br />Or in other object..?<br /><br />Setting to debug level the logs of the SP he gave me no further details.<br /><br />IJ.
</body></html>
<br><br/><br/>VOUCHER CONNETTIVITÀ per P.IVA e PMI: internet a canone 0 per 48 mesi. ATTIVA ORA<br />
<a href='https://casa.tiscali.it/promo/?u=https://promozioni.tiscali.it/voucher_business/?r=TS00000A00025&dm=link&p=tiscali&utm_source=tiscali&utm_medium=link&utm_campaign=voucherbusiness&wt_np=tiscali.link.footermail.voucherbusiness.btb..' target='_blank'>https://casa.tiscali.it/promo/?u=https://promozioni.tiscali.it/voucher_business/</a><br/><br/>