[JIRA] Resolved: (SSPCPP-402) Support front-channel SLO without cookies

[Scott Cantor (JIRA)]

     [ https://issues.shibboleth.net/jira/browse/SSPCPP-402?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Scott Cantor resolved SSPCPP-402.
---------------------------------

    Resolution: Fixed

http://svn.shibboleth.net/view/cpp-sp?rev=3813&view=rev

If no session is "active" for the request, and a logout request comes in, it invokes logout indirectly if it can locate the session by NameID and skips front channel notifications.

If a session is "active" it still enforces a match between that session and the NameID in the logout request. So you can't deliver somebody else's logout as an active user, but the third party cookie problem should be fixed.

> Support front-channel SLO without cookies
> -----------------------------------------
>
>                 Key: SSPCPP-402
>                 URL: https://issues.shibboleth.net/jira/browse/SSPCPP-402
>             Project: Shibboleth SP - C++
>          Issue Type: Improvement
>          Components: SAML 2.0 Logout
>            Reporter: bajnokk at idp.protectnetwork.org
>            Assignee: Scott Cantor
>             Fix For: 2.5.1
>
>   Original Estimate: 2 days
>  Remaining Estimate: 2 days
>
> If the SP could terminate the session based on NameID only, then front-channel Single Logout UI implementation wouldn't require acceptance of third party cookies. The request can be authenticated based on the signature, which is also mandated by the profile.
> On the other hand, I admit that front-channel application notification is quite useless without cookies, but I think it's more a deployment issue. (There are other ways to tie the app session to the Shibboleth session.)

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira