Integrating CAS into logout/SLO

[Marvin Addison]

I'm keen on completing IDP-645
<https://issues.shibboleth.net/jira/browse/IDP-645> prior to 3.2.0 and I've
been doing some recon to see what's required. The CAS-specific pieces are
straightforward, but I'm thinking more about integration with the IdP
logout process and SLO specifically. If I squint, I believe I can see how
the SLO piece is intended to be protocol agnostic: implement a logoutprop/X
flow for protocol X and given a proper selector function it will be
selected and executed for each suitable SPSession bound to the IdPSession.
Is that right? Anything else notable to be aware of?

It looks like there are two endpoints for logout depending on what is
desired:
1. /profile/Logout - ends IdPSession
2. /profile/PropagateLogout - sends SLO message to each IdPSession bound to
the IdPSession

What's the relationship between the two? It looks like logout+SLO requires
two separate requests to each endpoint, PropagateLogout followed by Logout
(order seems to matter). Is that correct? Don't see any problems thus far.

One potential problem is the following javadoc comment
on LogoutPropagationFlowDescriptor:

Flows may not interact with the client, and must include an activation
predicate to indicate their suitability based on the content of the {@link
ProfileRequestContext}, particularly the required {@link LogoutContext}
child context.

I was hoping that logoutprop/X flows could optionally interact with the
browser so we could do front-channel messaging. I vaguely recall Scott
discussing that at some point in the past (IFRAMEs and such), which seems
like a front-channel construct, so I'm confused about what sorts of things
logout propagation flows can do.

In terms of work and scheduling, I believe my CAS-specific issue should
depend on the larger SLO work. Is IDP-224 the right issue for that?

M
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20150617/00e01da5/attachment.html>