WSO2 Identity Server - Logout on secondary IDP - Why does LogoutRequestProcessor say session index not in Logout request when it is?

Question

I have a primary and secondary IS configuration same as:

https://docs.wso2.com/display/IS500/Connecting+Two+Identity+Servers+with+SAML+SSO.

I login via secondary IDP. Then I issue an IDP initiated logout. Something like:

https://host/samlsso?slo=true&spEntityID=spEntityID

A logout request is then sent from the primary to the secondary, but then the secondary logs the following error:

TID: [0] [IS] [2015-11-13 12:56:56,011] DEBUG {org.wso2.carbon.identity.sso.saml.servlet.SAMLSSOProviderServlet} -  Query string : SAMLRequest=nZJfT8MgFMXf%2FRSE9279Y91G1k6TxaSJzsROH3yjFDqUQuWyZX57S%2Bfm9MEHXwhczj05%2FC7zxb5VaMctSKMzHI1CjLhmppa6yfDT%2BjaY4kV%2BMQfaqrgjd6YxW%2FfI37ccHFr2i9TUDa0b5zog4%2FGOKlkPtcAN981ISMuZ7Q9MSS0ZVSNm2rG3BDAYFcsMq7rrRKuaTjVC6uptI0TFuN6YttnU7FVWVSOp1G2vBtjyQoOj2mU4DqM0iKIgStZRTNIrkiSjy0n0gtHKuAf9YG%2BE4%2FanLiFh9K175BR8%2FrJPqjg6vBCj5yOS2CPpIWkgBwgZ3lpNDAUJRNOWA3GMlDf3d6SXks4aZ5hROD8wI0Nee%2B7wtwEF4Nbjw%2FmJGyrK%2Bfjc7mi%2B6tuLJbo1tqXub19fkXUgBinh2kn3gf8Vy481Tq8F8xs%2FymO2Q5r8%2BFlKDh5hoWu%2Bz0VazcI0ZMEsjKfBJetnUcUsCcSMT2pWx9NZGH75%2FOo8VX98vvwT&RelayState=fa32a09d-718b-4342-8eb0-11f6ba8a0074&SigAlg=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23rsa-sha1&Signature=QwEOj%2BQoPXAJscKV9%2BEVcvR%2FqzGr7IPs%2FlTsMIIK8PP0mCDGOKgwVZ96zVv2jZtYyhjMIzVvQRx8x6kJG6RNtrnkbfakHtMJE6WuB8I9IX%2B6cGoJ47RBh79WxjN8EVjOpn9BX%2BGIXdK5ds8ZkP9KGQ80Nj3BfHxHlbhJ4QKSSOwtBrlZm7oPFQjpEuMHHHnLihaaQbSLrLk%2FdwfMHgfdqxayU9nJs31Ay1lT4fiIuCM2WDZc%2BBd4m0Lc8fdGgOYgEUoIby511pRck17Za6x%2B8x2bQgNLhilmcx i5aEvZPx66FD799Fzxz3qIFOBr%2FDw%2Fieq3emGMWbx%2FQRLuAPfOSQ%3D%3D {org.wso2.carbon.identity.sso.saml.servlet.SAMLSSOProviderServlet}

TID: [0] [IS] [2015-11-13 12:56:56,012] DEBUG {org.wso2.carbon.identity.sso.saml.util.SAMLSSOUtil} -  Request message <?xml version="1.0" encoding="UTF-8"?>
<saml2p:LogoutRequest Destination="https://validation-testing.firecrestclinical.com/samlsso" ID="ldppfmlgplgfinbkhffbcenhomghdcjibbgiainm" IssueInstant="2015-11-13T12:56:33.471Z" NotOnOrAfter="2015-11-13T13:01:33.471Z" Reason="Single Logout" Version="2.0" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">firecrest IS</saml2:Issuer><saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">[email protected]</saml2:NameID><saml2p:SessionIndex>f5b9050c-9028-4c11-b2c3-f9e7dcd28900</saml2p:SessionIndex></saml2p:LogoutRequest> {org.wso2.carbon.identity.sso.saml.util.SAMLSSOUtil}

TID: [0] [IS] [2015-11-13 12:58:43,668] ERROR {org.wso2.carbon.identity.sso.saml.processors.LogoutRequestProcessor} -  Session index value not found in the request {org.wso2.carbon.identity.sso.saml.processors.LogoutRequestProcessor}

You can see the session index in the message so why does the LogoutRequestProcessor say the session was not found in the request? After downloading the source and attempting to debug I cannot find the corresponding source code for the LogoutRequestProcessor log message? Do you have any ideas on this problem?

Also worth mentioning that the when receiving the Logout request, the SAML2 token Id is null when trying to read the cookie from request. However, this cookie was in my browser when logging out?

I can't reproduced your scenario yet. I am follow the WSO2 Doc your refer it's worked without error. 1. Please can you describe your environment in details(if it is cluster/or else ?) and you used any load balancer? 2. Plus your working version of WSO2 IS and java ? Is it your ACS url in WSO2 IS (Primary SP creation) side and travelocity.com properties ([apache_webapp]\travelocity.com\WEB-INF\classes)file are exactly same or is there any difference? 3. Add the full debug logs for SAML2 sso component. — KWick

Claude Falbriard Claude Falbriard · Accepted Answer · 2016-06-02T11:49:52

Testing a federated IdP connection using SAML. O also get a similar error when doing a logout.

The error message at the intermediate WSO2 IdP is:

TID[-1234] [IS] [2016-06-02 10:54:13,239] ERROR {org.wso2.carbon.identity.sso.saml.processors.SPInitLogoutRequestProcessor} - ssoTokenId cookie not found in the logout request

The the following logout request was sent by the Travelocity tool:

saml2p:LogoutRequest xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
                      Destination="https://wso2.red.com:9443/samlsso"
                      ID="omglmhflmkgjeabbmedkogjgggfbkkobpemlonaa"
                      IssueInstant="2016-06-02T11:34:41.282Z"
                      NotOnOrAfter="2016-06-02T11:39:41.282Z"
                      Reason="Single Logout"
                      Version="2.0"
                      >
        <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">wso2_saml_sandbox_claude</saml2:Issuer>
        <saml2:NameID xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
                      Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"
                      >[email protected]</saml2:NameID>
        <saml2p:SessionIndex>uuid10ba3d9d-0155-15d5-9fc0-b62b3428c817</saml2p:SessionIndex>
</saml2p:LogoutRequest>

Support to fix this issue is welcome.

WSO2 Identity Server - Logout on secondary IDP - Why does LogoutRequestProcessor say session index not in Logout request when it is?

1 Answers