Status 22 and message Partial Logout

Products

• CA Single Sign On Agents (SiteMinder)

Issue/Introduction

The smps.log and smtrace log contain "status 22" and a status of "partial logout".

The logs will show this:

smps.log

[SingleLogoutTunnelServiceHandler.java][ERROR][sm-FedServer-xxxxx] Transaction ID: xxxxxxxx-xxxxxxxx-xxxxxxxx-xxxxxxxx-xxxxxxxx-x failed. status=22&message=Partial Logout
[SingleLogoutTunnelServiceHandler.java][ERROR][sm-FedServer-xxxxx] Single Logout : Will not delete session.

smtrace log

<LogoutResponse xmlns="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://example.com/xxxx/xxxx/saml2slo" ID="_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" InResponseTo="_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" IssueInstant="2024-11-05T06:58:52Z" Version="2.0"><ns1:Issuer xmlns:ns1="urn:oasis:names:tc:SAML:2.0:assertion">login.example.com</ns1:Issuer><Status><StatusCodeValue="urn:oasis:names:tc:SAML:2.0:status:Success"><StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:PartialLogout"/></StatusCode></Status></LogoutResponse>

Environment

SiteMinder 12.8.x

Resolution

This is expected behavior. Even though SM session at the IDP site has expired, the IDP site would respond to the logout request sent by the SP. The IDP side would send a logout response with primary status as Success and secondary status as Partial logout.

You can confirm this is what is happening by increasing the session timeout (double or triple the current timeout) and verify that the number of these messages decreases significantly or possibly stops completely.

You could also reproduce and monitor the session in the session store to confirm that this only happens when a session has been removed from the session store due to session timeout.