Closed walgarcia closed 4 years ago
Seems to be a logical flow, and probably not a bug. Reopen this issue if you do believe it is a bug.
You will want to set a break point at NameID nameID = getNameID(context, logoutRequest);
I found context and credential nameID differ in the format field, due to idps saml message.
so equalsNameID(credential.getNameID(), nameID)
fails.
2019-10-01 12:53:01.535 TRACE --- [nio-8443-exec-1] o.s.s.s.websso.SingleLogoutProfileImpl : context nameID: object org.opensaml.saml2.core.impl.NameIDImpl@43493cab
2019-10-01 12:53:01.535 TRACE --- [nio-8443-exec-1] o.s.s.s.websso.SingleLogoutProfileImpl : context nameID: value() walgxxx@xxx.edu.co
2019-10-01 12:53:01.535 TRACE --- [nio-8443-exec-1] o.s.s.s.websso.SingleLogoutProfileImpl : context nameID: format() null
2019-10-01 12:53:01.537 TRACE --- [nio-8443-exec-1] o.s.s.s.websso.SingleLogoutProfileImpl : context nameID: nameq() null
2019-10-01 12:53:01.537 TRACE --- [nio-8443-exec-1] o.s.s.s.websso.SingleLogoutProfileImpl : context nameID: spprov() null
2019-10-01 12:53:01.537 TRACE --- [nio-8443-exec-1] o.s.s.s.websso.SingleLogoutProfileImpl : context nameID: spname() null
2019-10-01 12:53:01.538 TRACE --- [nio-8443-exec-1] o.s.s.s.websso.SingleLogoutProfileImpl : context nameID: childn() null
2019-10-01 12:53:01.538 TRACE --- [nio-8443-exec-1] o.s.s.s.websso.SingleLogoutProfileImpl : credentials nameID: object org.opensaml.saml2.core.impl.NameIDImpl@44afe458
2019-10-01 12:53:01.538 TRACE --- [nio-8443-exec-1] o.s.s.s.websso.SingleLogoutProfileImpl : credentials nameID: value() walgxxx@xxx.edu.co
2019-10-01 12:53:01.538 TRACE --- [nio-8443-exec-1] o.s.s.s.websso.SingleLogoutProfileImpl : credentials nameID: format() walgxxx@xxx.edu.co
2019-10-01 12:53:01.538 TRACE --- [nio-8443-exec-1] o.s.s.s.websso.SingleLogoutProfileImpl : credentials nameID: nameq() null
2019-10-01 12:53:01.538 TRACE --- [nio-8443-exec-1] o.s.s.s.websso.SingleLogoutProfileImpl : credentials nameID: spprov() null
2019-10-01 12:53:01.538 TRACE --- [nio-8443-exec-1] o.s.s.s.websso.SingleLogoutProfileImpl : credentials nameID: spname() null
2019-10-01 12:53:01.538 TRACE --- [nio-8443-exec-1] o.s.s.s.websso.SingleLogoutProfileImpl : credentials nameID: childn() null
2019-10-01 12:53:01.539 DEBUG --- [nio-8443-exec-1] o.s.s.saml.SAMLLogoutProcessingFilter : Received logout request is invalid, responding with error
thanks @fhanik
You are welcome @walgarcia
@walgarcia I am facing similar issue with ADSF IDP ?Did you find any solution to this ?
@ripjal The solution was to patch the code:
private boolean equalsNameID(NameID a, NameID b) {
boolean equals = !differ(a.getSPProvidedID(), b.getSPProvidedID());
equals = equals && !differ(a.getValue(), b.getValue());
//
// Azure adsf doesnot include format!!! so skip
//
//equals = equals && !differ(a.getFormat(), b.getFormat());
equals = equals && !differ(a.getNameQualifier(), b.getNameQualifier());
equals = equals && !differ(a.getSPNameQualifier(), b.getSPNameQualifier());
equals = equals && !differ(a.getSPProvidedID(), b.getSPProvidedID());
return equals;
}
@walgarcia ahh...I was thinking this must be misconfiguration at ADFS side which could be corrected. So I believe you overrode the SingleLogoutProfileIMpl and copied almost all processLogoutRequest method and just commented this one line which is comparing the format.
@ripjal I did not have access to the adfs configuration so this was the workarround.
The idp (an ADSF) sends the folowing LogoutRequest
The following error is reported by the logout request processor:
the sp.xml contains
Is this an issue when working with an ADSF idp ? Is the idp obliged to describe the format of the NameID ?