version 3 update on wiki and TNC2014

[Cantor, Scott]

On 3/23/14, 2:58 PM, "Scott Koranda" <skoranda at gmail.com> wrote:
>I see that the TNC2014 Shibboleth Consortium session detailed at
>https://tnc2014.terena.org/core/event/7
>will include a discussion of IdP v3. Can it include some details about
>"logout" and what functionality might be supported for v3?

It's going to be a fairly open session, so depending on the number of
people, it may be a direct discussion amongst the members present, or a
presentation style update like at ACAMP.

I don't really have a lot to say about logout, so if somebody wants to
talk about it, I'd suggest they just do it here, any time.

>I also see on this wiki page
>
>https://wiki.shibboleth.net/confluence/display/DEV/Project+Roadmap#Project
>Roadmap-IdP,version3
>
>that v3 has a Q3 2014 estimated completion date listed. Do you feel
>that is still accurate?

That's the target, but I think we're planning around Q4 to be safe. The
original projection in 2012, after Chad left, was Q2 2014, so given the
incredibly small number of FTE working on this and the scope of the
effort, I'm very comfortable with the progress and the amount of slippage.

>Lastly I see these words on the wiki page at
>
>https://wiki.shibboleth.net/confluence/display/DEV/IdP3Details
>
>"Therefore, the plan for the initial support of SLO will be to allow
>an SP to initiate an SLO request either via the front-channel or
>back-channel but the propagation of that request to other SPs will be
>exclusively via the back-channel."
>
>Is that still an accurate statement (the page has not been updated
>since 2012 so I expect the answer is 'no' but want to be sure)?

Those are all Chad's original notes from the threads on this list, so
you're correct, they are not up to date. I will try and edit that material
where it's not a huge amount of effort to and make sure there is team
consensus about what they say, and get rid of anything I can't fix up to
be reasonably accurate.

All I can say about logout is that once Chad left, any promises to do more
than replicate V2 functionality pretty much ended. What was added to 2.4
was done with the understanding that it would need to be included in 3.0,
but that doesn't include that SOAP functionality.

However, the session cache has been done for a while, and is capable of
tracking and lookup of sessions properly for logout if it's stored
server-side. The only reason we couldn't include back channel logout
support is if the SOAP client support, which has never been used by the
IdP really at all, turns out not to work well. Otherwise it's too simple
not to include. It just won't do much good for most applications.

-- Scott