Shibboleth.sso/Logout questions

[Cantor, Scott]

> I haven't been able to see the "partial logout" report yet, as I can't
> currently test against an IdP that doesn't support SLO.  But I know that I
> will have such IdPs, as well IdPs that do support SLO.  Hence my question.

Ok, normally that's a pretty easy one since most IdPs don't support it, so I assumed you had seen it.

> 1) If the IdP supports SLO then (all being well) it will first logout on the
> IdP, then logout the local Shib session, and then return to my addr.

The local session is disposed of before it sends the request to the IdP.

Any time the IdP is involved, the UI is up for grabs, and it's possible your return parameter will mean very little, hidden by an iframe or something like that. It's unlikely the SP will get any real UI control back. 

> 2) If the IdP doesn't support SLO then it will logout the local Shib
> session, but then report a partial logout and /not/ return to my addr?

See the documentation on the LogoutInitiator in question and it will tell you how it behaves.

-- Scott