By: Guy Parker named 16 Mar 2018 at 9:57 a.m. CDT

3 Responses
Guy Parker gravatar
We are seeing an issue with OpenID Connect Single Log Out where the page that should load each active RP's front channel logout URI in multiple iframes only contains a single iframe. We can consistently reproduce the following: 1. Login using RP1 1. Switch to RP2 1. Return to RP1 1. Logout with a request for end_session 1. Watch a single iframe load requesting the front channel logout URI of RP1 1. Switch to RP2 and session is still active We can swap RP1 and RP2 in the steps above with the result that RP2's front channel logout URI is loaded in the iframe and RP1's session remains active Can you provide suggestions as to how to debug what is happening here further? Thanks Guy

By Aliaksandr Samuseu staff 16 Mar 2018 at 10:13 a.m. CDT

Aliaksandr Samuseu gravatar
Hi, Guy. Please create and share a HAR file with a capture of the whole failing flow. You can use steps listed [here](https://www.inflectra.com/support/knowledgebase/kb254.aspx) - please use Firefox for that, Chrome's HARs are flawed. Also don't forget to set "Persist log" and "Disable cache" checkboxes in the console to save everything, not just the recently loaded page. In addition, please provide a full dump of settings of both clients in question (I assume each RP uses its own client) from LDAP: 1. Open the client's properties in web UI and copy its "Inum" value 2. Move into Gluu's container 3. Put your LDAP password in `/tmp/.dpw` (it's the same as default admin's password was right after installation) 4. Dump the client's properties: `# /opt/opendj/bin/ldapsearch -h 127.0.0.1 -p 1636 -s sub -T -Z -X D 'cn=directory manager' -j /tmp/.dpw -b 'o=gluu' -z 3 '&(objectclass=oxauthclient)(inum=YOUR_INUM)'` 5. Repeat the process for the next one 6. Share it here. You may decide to remove client's secret from output

By Guy Parker named 16 Mar 2018 at 11:08 a.m. CDT

Guy Parker gravatar
Hi Aliaksandr, Yep, I can sort that out if you leave it with me for a couple of days. Thanks for the fast reply. Guy

By Mohib Zico staff 28 Mar 2018 at 9:27 a.m. CDT

Mohib Zico gravatar
Hello Guy, Please reopen the ticket when required. Closing for now.