What is the Shibboleth alternative to a logout function?

[Cantor, Scott]

On 12/20/11 3:19 PM, "Jason Holland" <jholland at olp.net> wrote:

>I'm trying to figure out what the best practices are regarding security
>when managing a federation that uses a Shibboleth IdP.

There aren't really any, that's the problem we're identifying in the wiki.

>Since Shibboleth doesn't support SLO how does a user end their SSO
>session if they were logged into a Service Provider that had sensitive
>data? Or in other words how should a Service Provider behave in order to
>protect sensitive data when the user is done?

User accountability, and using options like forceAuthn in conjunction with
additional controls like timeouts and other checks.

Closing the browser used to be the obvious answer, but Firefox has ended
that for all intents and purposes.

But if your SP offers a logout function, that does you no good when the
user has moved on to some other SP, and if your logout happens to also
blow away the IdP session (which is achievable) then you just end up
breaking SSO anyway.

-- Scott