Partial logout feature in upcoming IdP release

[Scott Koranda]

> As some have possibly observed, I have been checking in code for a logout
> handler in the IdPv2 branch. This was originally going to be an extension
> Chad was planning to do, and because of other decisions, we have reopened
> some work on V2 for another feature release for the first quarter of next
> year.
> 
> Logout is a contentious rathole, and I'm not going to revisit it, but I
> wanted to call attention to it for a couple of reasons.
> 
> - more testing
> - vetting of behavior
> 
> I have completed a write up of the feature here:
> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPEnableSLO
> 
> I have been very meticulous in describing what this does and does not do.
> If something is unclear, please ask and I'll do my best.

I have some questions (which do not necessarily mean anything
is unclear to most).

At the URL above I read

"Due to a design limitation in this version, the IdP cannot
access more than one session at a time for a given subject
identifier. This works okay with transient or
directed/persistent identifiers, but limits the IdP's ability
to terminate all of the sessions associated with an identifier
even if that might be useful."

1) When you write "Due to a design limitation in this version"
do you man this version of the enhanced logout functionality
or a design limitation in the 2.x series of the IdP?

2) What does "...the IdP's ability to terminate all of the
sessions associated with an identifier" mean?

I thought that if I had two LoginHandlers, one using
username/password and one using X.509, I still only had one
session with the IdP--a session that tracked (possibly) two
authentication events each with (most likely) distinct
authentication durations. And once that IdP session either
timed out due to inactivity or is otherwise terminated then
any "time left" for the authentication duration of a
LoginHandler did not matter because the IdP no longer "knew
who I was".

I am referencing the discussion found at

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthnSession

So I am confused by the notion of "all of the sessions
associated with an identifier"?

3) Suppose I have decided for my IdP to forgo all SOAP endpoints (no
artifact resolution or attribute query), put multiple IdPs
behind a load balancer that does SSL termination, and rely on
"persistence/server affinity/sticky sessions" managed by the
load balancer (no Terracotta or other techniques, and I am
willing to pay the cost to the user when there is a fail over).

Since you write "...over both SOAP and front-channel bindings"
I should still be able to leverage this new limited logout functionality,
correct?

I understand that the SP must support the front-channel
binding of course.

Thanks,

Scott K