SLO uses an earlier transient NameID after repeated ACS to the same SP

[EkaLinMan]

Hello, I would like to ask about a SAML SLO behavior that I observed in OpenAM Server 14.6.4 (Open Identity Platform Community).

Environment

• IdP: OpenAM Server 14.6.4
• Product: Open Identity Platform Community
• SP1: our application
• SP2: another SAML Service Provider participating in the same IdP session
• NameID format involved in this scenario appears to be transient

Scenario

I observed the following sequence:

1. A user logs in to SP1 through the IdP.
2. Later, the local session of SP1 times out, but the IdP session is still alive.
3. The user accesses SP1 again.
4. Because the IdP session is still valid, the user is sent through SAML SSO again and completes another ACS login to the same SP1, without having to log in again at the IdP.
5. Later, SP2 triggers SLO, and the IdP sends a LogoutRequest to SP1.

What I observed

From the SAML traces on the SP side, it looks like:

• SP1 completed ACS successfully more than once within the same IdP session.
• The two ACS logins to SP1 resulted in different transient NameID values.
• However, when the IdP later sent a LogoutRequest to SP1, the NameID in that LogoutRequest appeared to match the earlier ACS login, not the most recent one.
• On the SP1 side, the current authenticated session was associated with the newer NameID, so the logout validation failed because the NameID values did not match.
• The repeated ACS logins to the same SP appeared to occur within the same IdP session, and the SessionIndex also appeared to remain unchanged.

My questions

1. Is this the expected SLO behavior in OpenAM?
   When the same SP completes ACS multiple times within the same IdP session, should OpenAM continue using an earlier stored NameID for SLO to that SP, or should it use the NameID from the latest successful ACS login?

2. Is there any recommended way to handle this scenario?
   For example, is there a supported way to make SLO use the latest NameID for that SP, or is this considered a known limitation / bug?

Any clarification would be greatly appreciated. Thank you!

[vharseko]

• Fix SLO sending stale transient NameID when SP re-authenticates within same IdP session #984

Please check the behavior on the artifact from snapshot version or direct link

[EkaLinMan]

Thank you for providing the fix. We may not be able to test it on our side in the short term. Could you please let us know whether this change is still planned to be merged into master and included in a future release, even if we are unable to verify it promptly?

[vharseko]

The community expects your help in verifying this fix to confirm the solution to the problem for inclusion in the next release

[EkaLinMan]

Thank you for the update. We may need some time to set up the environment on our side before we can properly test this fix, so it may take a little while.

[EkaLinMan]

Hi @vharseko Thank you for your assistance. We have verified via the snapshot that the SLO is utilizing the NameID associated with the most recent ACS login for that SP.