Asynch SLO Work

[Chad La Joie]

I think I already answered this in the original mail.

We are *not* committing to do anything other than kill off the IdP session.

*If* we do anything more, it will be a back-channel logout request as
specified by the SAML spec.

That's it.

On Fri, Jul 6, 2012 at 10:47 AM, Russell Beall <beall at usc.edu> wrote:
> I would recommend a customization to this such that if you don't implement a full SLO approach, a deployer could configure a list of entityIDs which are considered "important" for logout and these services could be hit whether they are in the user session or not.
>
> Will Norris wrote a section into our logout page which uses a hidden div element to load logout links as images in the background. This wasn't used for SP logout but for other non-shib campus services. I found it works equally well with the SP logout link.
>
> I was going to start adding Logout links of many "important" SPs to this but then we found that it was inappropriate for any individual SP to logout the user from the "University" so we are not going to add those after all to the IdP-only logout page.
>
> They could be added to a global logout page and then we would have only our campus portal use it.
>
> I'd rather have the IdP maintain the list of "important" SPs and more correctly issue logout requests rather than have it maintained in a jsp page.
>
> Russ.
> (iPhone)
>
>
> On Jul 6, 2012, at 7:33 AM, Chad La Joie <lajoie at itumi.biz> wrote:
>
>> On Fri, Jul 6, 2012 at 9:21 AM, Steven Carmody <Steven_Carmody at brown.edu> wrote:
>>> Will an SP have to know whether to send the protocol extension or the
>>> original protocol to a specific IDP? Presumably based on the IDPs
>>> metadata ?
>>
>> Yes, the SP will have to understand the extension and use it.  How it
>> does that for the Shib SP will be up to Scott (I would guess it would
>> just be enabled by default).
>>
>> --
>> Chad La Joie
>> www.itumi.biz
>> trusted identities, delivered
>> --
>> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered