KeyError on logout

[earthlyreason]

Thanks for your work on this plugin. It has been immensely helpful for our project.

We have run into an issue where logging out consistently results in a crash. Following is a stack trace from one such occurrence:

Traceback (most recent call last):
  File "/usr/lib/ckan/venv/local/lib/python2.7/site-packages/paste/httpserver.py", line 1093, in process_request_in_thread
    self.finish_request(request, client_address)
  File "/usr/lib/python2.7/SocketServer.py", line 334, in finish_request
    self.RequestHandlerClass(request, client_address, self)
  File "/usr/lib/python2.7/SocketServer.py", line 655, in __init__
    self.handle()
  File "/usr/lib/ckan/venv/local/lib/python2.7/site-packages/paste/httpserver.py", line 460, in handle
    BaseHTTPRequestHandler.handle(self)
  File "/usr/lib/python2.7/BaseHTTPServer.py", line 340, in handle
    self.handle_one_request()
  File "/usr/lib/ckan/venv/local/lib/python2.7/site-packages/paste/httpserver.py", line 455, in handle_one_request
    self.wsgi_execute()
  File "/usr/lib/ckan/venv/local/lib/python2.7/site-packages/paste/httpserver.py", line 305, in wsgi_execute
    self.wsgi_start_response)
  File "/usr/lib/ckan/venv/src/ckan/ckan/config/middleware/__init__.py", line 202, in __call__
    return self.apps[app_name](environ, start_response)
  File "/usr/lib/ckan/venv/local/lib/python2.7/site-packages/repoze/who/middleware.py", line 100, in __call__
    challenge_app = api.challenge(wrapper.status, wrapper.headers)
  File "/usr/lib/ckan/venv/local/lib/python2.7/site-packages/repoze/who/api.py", line 191, in challenge
    forget_headers)
  File "/usr/lib/ckan/venv/src/pysaml2/src/saml2/s2repoze/plugins/sp.py", line 280, in challenge
    responses = _cli.global_logout(name_id)
  File "/usr/lib/ckan/venv/src/pysaml2/src/saml2/client.py", line 161, in global_logout
    entity_ids = self.users.issuers_of_info(name_id)
  File "/usr/lib/ckan/venv/src/pysaml2/src/saml2/population.py", line 44, in issuers_of_info
    return self.cache.entities(name_id)
  File "/usr/lib/ckan/venv/src/pysaml2/src/saml2/cache.py", line 151, in entities
    return list(self._db[cni].keys())
  File "/usr/lib/python2.7/shelve.py", line 121, in __getitem__
    f = StringIO(self.dict[key])
  File "/usr/lib/python2.7/bsddb/__init__.py", line 270, in __getitem__
    return _DeadlockWrap(lambda: self.db[key])  # self.db[key]
  File "/usr/lib/python2.7/bsddb/dbutils.py", line 68, in DeadlockWrap
    return function(*_args, **_kwargs)
  File "/usr/lib/python2.7/bsddb/__init__.py", line 270, in <lambda>
    return _DeadlockWrap(lambda: self.db[key])  # self.db[key]
KeyError: '2=urn%3Aoasis%3Anames%3Atc%3ASAML%3A2.0%3Aattrname-format%3Auri,4=auth0%7C5d97acb0f208d00e16eca79c'

This is apparently an issue with the underlying pysaml library. For context, see

• KeyError with logout #127 from the djangosaml2 project, and
• Logout requests raises KeyError #281 from the pysaml2 project.

Following on this comment from the latter thread, we have worked around the issue using the approach of making the client a singleton.

Have others run into this issue, and is there a preferred approach to resolving it?

Thanks again.