specifying logout endpojnt at the IDP

[Cantor, Scott]

On 6/13/12 2:45 PM, "Chad La Joie" <lajoie at itumi.biz> wrote:

>Well, that's how you advertise an endpoint supporting the Single
>Logout profile.  If your endpoint doesn't meet that profile then using
>that element was be inappropriate.

This is more art than science, but the way it sort of works is that the
built-in metadata elements are meant to refer to profiles that are
associated with protocol "families" signaled in the
protocolSupportEnumeration attribute on a role.

While it doesn't technically break anything to pick a custom binding and
use that in an element to signal that it's something "special", the intent
is that if it's not SAML 2 protocol, you also define a custom protocol
string and put that in the enum if you reuse the built-in elements for
your own custom protocols.

That's why Shibboleth defined a protocol string when it chose to reuse the
<SingleSignOnService> element for the legacy request format.

-- Scott