0

The WSO2 Identity Server 4.6.0 can't process the following SAML (SLO) logout request:

<saml2p:LogoutRequest Destination="https://idp:9443/samlsso"
ID="_f2a42cceb9e680b8d91fafd44d05391d27afa997"
IssueInstant="2014-03-26T18:18:10.842Z"
Version="2.0"
xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
>
<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">sp</saml2:Issuer>
<saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
>REALM/[email protected]</saml2:NameID>
</saml2p:LogoutRequest>

It gives:

[2014-03-26 19:18:11,009] ERROR -  Error Processing the Logout Request {org.wso2.carbon.identity.sso.saml.processors.LogoutRequestProcessor}
java.lang.IndexOutOfBoundsException: Index: 0
        at java.util.Collections$EmptyList.get(Collections.java:3212)
        at org.opensaml.xml.util.LazyList.get(LazyList.java:89)
[...]
Caused by: java.lang.IndexOutOfBoundsException: Index: 0
        at java.util.Collections$EmptyList.get(Collections.java:3212)
        at org.opensaml.xml.util.LazyList.get(LazyList.java:89)
        at org.opensaml.xml.util.XMLObjectChildrenList.get(XMLObjectChildrenList.java:96)
        at org.opensaml.xml.util.XMLObjectChildrenList.get(XMLObjectChildrenList.java:32)
        at org.wso2.carbon.identity.sso.saml.processors.LogoutRequestProcessor.process(LogoutRequestProcessor.java:114)
        ... 38 more

Any idea why, and how to remediate?

UPDATE:

I believe it is related to the element of SessionIndex, but according to the http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf SAML documentation it is optional in LogoutRequest.

2 Answers 2

0

I do not understand the above error message, but maybe you are on the right track.

In the document you posted also says the sp MUST include a SessionIndex (it says "at least one") , see line 1302

After all if you do not include a session index, how should the idp know what session to terminate and which other session participants should be informed about the logout?

0

Yes, SessionIndex is a must.

SessionIndex - This is the session identifier that is used to identify the user session with both IDP and SP for given user.

Pleae refer How SAML2 Single Logout Works for more details.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.