Partial logout feature in upcoming IdP release

[Cantor, Scott]

On 11/27/12 11:21 AM, "Steven Carmody" <Steven_Carmody at brown.edu> wrote:
>
>A question about Local Logout --
>
>it sounds like you plan to provide a Local Logout endpoint at the IDP
>that would terminate the active session and then render the logout.jsp
>page that was customized by the site. That seems to be the basic process.

Yes.

>Would horrible things happen if the site tried to put a page at the
>Local Logout endpoint asking the user if they wanted to kill their SSO
>session ? Clicking YES would send the user to the processing described
>above.

You could with a lot of rewrite hackery, but I think you'd be better off
just having whatever that page is be the place you send people first
rather than the endpoint in the IdP.

The key point I think to make is that it does not work this way in
general, and the SAML logout request processing would not allow for this,
so it's not really part of the intended behavior I was trying to support.
One of the major simplifications was not having to interact with the user
to do the logout processing.

-- Scott