Single Logout?

[Kristof Bajnok]

On 2011. August 15. 09:37:14 Naveen Davis wrote:
> I am trying to create a test service that allows user to choose between
> local logout and single logout. 

I'd save the term "local logout" for cases where you do only SP session 
removal, without any interaction with the IdP. (In other words: a local-only 
LogoutInitiator.)

> I am testing these scenarios with the Hungarian SLO Idp.

Ehm... I don't remember anymore if we have such a service. Is it a demo or 
something like that?

> The second test scenario is that it should logout
> from the current SP (from where the single logout was called) and the
> Idp. But it should not affect the other active SP sessions. I am not
> sure how to approach this problem. Could you please help me out.

I don't understand what you are trying to get. The UI is such that the user 
can instruct the IdP either to send SLO messages to all of the other SPs or 
not. (The latter is not standard SAML2 SLO.) 

It's not possible to 'abort' the logout process, so to leave the user with a 
valid IdP session. If this is what you want to achieve, you must configure 
"local logout" (see above) at the SP, and have your application redirect the 
user to that particular LogoutInitiator.

Kristof