SAML SSO 2.1.1, error screen when logging out?

[Jonathan Smith]

Hi all,

  To those who upgraded their SAML SSO add-on to 2.1.1, do you get an error screen in Confluence or JIRA when choosing log out?

JIRA = 500 error

Confluence =

java.lang.ClassCastException: com.resolution.atlasplugins.samlsso.tracker.activeobjects.AuthenticationTrackerActiveObjectsProxy cannot be cast to java.lang.String
at com.resolution.atlasplugins.samlsso.servlet.LogoutServlet.processRequest(LogoutServlet.java:51)

I did open a ticket with the vendor, but wanted to see if anyone else is experiencing this issue.

Note: non-sso page works fine, it is just the log out page.

[Christian Reichert (resolution) · Accepted solution]

Hi @Jonathan Smith,

your Issue Report is the only one we have on this so far.

2.1.1 is rather new so there are less then a 100 Upgrades to that version and like you, most customers upgrade their dev/uat instances first.

Cheers,

  Chris

[Jonathan Smith]

Wednesday evening, Confluence PROD's log out page started working again magically..

JIRA UAT is still having the issue though (ADFS error page)

• Activity ID: 00000000-0000-0000-7a01-0080020000ec
• Error time: Fri, 27 Apr 2018 12:58:12 GMT
• Cookie: enabled
• User agent string: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.117 Safari/537.36

[Christian Reichert (resolution)]

Hi @Jonathan Smith,

sounds like it is as Jörg suspected in the support case, that this is a bug that only affects sessions which have been established before the upgrade. So this logout Issue would only affect users that had an active session during your upgrade. It would also "magically" start working again once their sessions naturally expire & new ones get created. With those new sessions they will not run into that logout error message.

Cheers,
   Christian   

[Jonathan Smith]

Resolved the issue:

After upgrading, the plugin changes the Binding settings from Logout Binding = DISABLE to POST. After changing it back to DISABLE, the logout screen appears correctly now.

[Jonathan Smith]

I'll confirm if the plugin changes that field next week when I upgrade JIRA PROD.  Will report back.

[Christian Reichert (resolution)]

Hi @Jonathan Smith,

I confirm this is a bug. It's been caused due to the fact that under certain circumstances this value could have defaulted to POST in our old config version for Plugins 2.0.x - even though it wasn't used there since Single Logout was still under development.

During Config migration to Plugin Versions 2.1.x, if the Value was already set, it did not get changed and only defaulted to DISABLE when not present before.

The correct behaviour in Config migration should have been to set this to DISABLE regardless of prior status. 

The fix has already been developed & accepted. So it will be part of the next Bugfix release.

If you go into production with 2.1.1 then the correct workaround is (what you worked out) to manually set the logout binding to DISABLE.

Sorry you experienced this & thanks again for figuring it out.

Cheers,
     Christian