[escherize]

Why

Some IdPs — notably Auth0 — issue several sessions for a single NameID and reject a
LogoutRequest that does not say which session to end:

client_error: No active session(s) found matching LogoutRequest

SAML Profiles §4.4.4.1 makes SessionIndex the element that scopes a LogoutRequest to a
session. Two gaps stopped us from using it:

• Assertion->map never read AuthnStatement, so the SessionIndex the IdP sent at login was
  discarded at parse time.
• build-logout-obj had no way to emit one.

Reported downstream as metabase/metabase#77837.

What

• Parse — Assertion->map now returns :session-index, read from the assertion's first
  AuthnStatement. nil when the IdP sends none.
• Emit — idp-logout-redirect-response / logout-redirect-location accept an optional
  :session-index. Existing positional arities are unchanged and pass no index.

Note the asymmetry in the OpenSAML API this mirrors: on login SessionIndex is an attribute
(AuthnStatement.getSessionIndex() → String); on logout it is an element appended to
LogoutRequest.getSessionIndexes().

The Azure AD constraint

A hardcoded SessionIndex was tried once before (b680a8e) and broke Azure AD
(metabase/metabase#41600), because a fabricated value matches no session. So:

Only an index the IdP itself issued is ever sent. With none, the element is omitted entirely —
not empty, not a placeholder — leaving the request byte-identical to before.

idp-logout-redirect-response-test, which asserts on the exact deflated+base64 encoded request,
is deliberately left unmodified. It passing is the regression guard.

How this was validated

Each step below answers a specific "how do you know?", in order of increasing realism.

1. The XML is shaped correctly, and omission is truly byte-identical.
Built both variants and compared serialized output with the clock pinned (the default
IssueInstant is now, so an unpinned comparison is meaningless — the first attempt at this
check was wrong for exactly that reason):

• with an index → <saml2p:SessionIndex> in the saml2p protocol namespace, positioned after
  NameID, per §4.4.4.1
• nil and blank → output identical to the pre-change path, to the byte

2. Parsing works on real assertions. Every fixture in test/saml20_clj/test/*.xml already
carried SessionIndex="_be9967abd904ddcae3c0eb4189adbe3f71e327cf93", so the exact-map assertions
in response_test.clj now pin it. No new fixtures needed.

3. The tests actually catch the regression they claim to. Mutation check: forcing the element
to always emit (when true instead of the non-blank guard) fails 5 assertions — the new test
and the pre-existing byte-exact legacy tests. Reverted, green again. Without this, "the legacy
test still passes" would be an untested claim about a test.

4. A real IdP accepts it. Ran Keycloak in Docker (docker-compose.yml) and POSTed two signed
LogoutRequests to its live SLO endpoint — one with a SessionIndex, one without. Keycloak
returned StatusCode: Success for both. Keycloak never had this bug, so this does not prove
the fix fixes anything; it proves the change does not break an IdP that already worked, which is
the #41600 failure class.

5. Real Auth0, end to end. Downstream in metabase/metabase#77837 a Metabase instance pointed at
a live Auth0 tenant now completes a full browser login/logout: Auth0 replies StatusCode: Success
with InResponseTo matching the request, and the session is deleted.

That took a second change in this PR. Sending the correct SessionIndex was not enough — Auth0 still
answered No active session(s) found matching LogoutRequest, because an IdP matches a LogoutRequest
on NameID + SessionIndex, and Metabase was sending a user's email where Auth0's NameID is an
opaque auth0|<id>. Hence :name-id-format, so an SP can echo back the Format from the login
assertion alongside the right NameID value.

A caution, since an earlier revision of this description got it wrong: do not verify against Auth0
with curl. It returns Success to an anonymous LogoutRequest unconditionally — including for a
fabricated SessionIndex and for a nonexistent user. Only a real browser session distinguishes
success from failure.

Suite: 42 tests / 197 assertions, 0 failures.

Release

VERSION.txt → 4.3.0. Merging to master auto-deploys to Clojars, which unblocks the Metabase PR.