IdpSession Logout Problems

[Kristof Bajnok]

On 28/10/11 21:02, Cantor, Scott wrote:
> The reason I didn't is that we already have that implemented: the back
> channel. Why bother doing it front channel and requiring that brittle UI
> if you can just do it via SOAP?

For a couple of reasons it can be more difficult to deploy:
  * SP clusters without shared Shibboleth sessions
  * back-channel authentication
  * outgoing TCP might not be allowed by some IdP cluster setups 
(firewalls or load balancers)
  * front-channel is preferred when available, so the front-channel 
bindings should be removed from the SP metadata for forcing back-channel 
(I think it's quite common to have front-channel SLO endpoints for SPs)

For the OP: more SLO issues:
https://fed-lab.org/best-practises/single-logout/
;)

However ugly is the current UI (in the Hungarian SLO-IdP), at least it 
never lies. When SLO is not working (because of 3rd party cookies or for 
some other reason), it tells that it failed, so do whatever you can to 
log off.

Kristof