Asynch SLO Work

[Chad La Joie]

Scott and I have been discussing SLO recently and the the risks posed
by things like Firefox's never-ending sessions.  As I'm sure most
people know, we've always been very skeptical of the ability of SLO to
function, especially acros organizational boundaries.  The data we've
collected so far from people deploying custom solutions indicates our
concerns were well founded.

An alternative solution that some organizations have adopted is to
provide a mechanism that only kills the IdP session.  While we think
this method is fine - assuming proper verbiage is displayed to the
user to let them know what just happened - it's debatable whether this
is allowed by the stock SAML standard.  As such I've gone ahead and
created a protocol extension[1] that can be used, during IdP and
SP-initiated logout requests, to indicate a slightly relaxed
processing model that does allow for just killing off the IdP session.
 If people have comments, please direct them to the SSTC (SAML
technical committee) comments list per OASIS's feedback
instructions[2].

Our current plan is for Scott to add support for this extension in SP
2.5 and for me to create a simple extension for IdPv2 that will
support killing off the IdP session.  We have also agreed to evaluate
how much work it would be for that extensions to send back-channel
requests out to SPs but we are not, currently, committing to do that
work.

[1] https://wiki.oasis-open.org/security/ASLO
[2] https://www.oasis-open.org/committees/comments/index.php?wg_abbrev=security

-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered