specifying logout endpojnt at the IDP

[Paul Hethmon]

Just as another point, I do make use of the Hungarian extension for SLO in
the Shib IdP, but I also make available what I call a simple logout page
as well. That simple page just kills the IdP session. I don't try to
publish it in the metadata, I just tell the RP's that they can use that if
they don't want to do SLO. Many of them do have a configuration point in
their application to send a user to a certain URL at the end of their
logout process.

Paul

On 6/15/12 10:27 AM, "Chad La Joie" <lajoie at itumi.biz> wrote:

>Well the standard says that <SingleLogoutService> is "Zero or more
>elements of type EndpointType that describe endpoints that support the
>Single Logout profiles defined in [SAMLProf]."  So, you either do that
>particular profile or you don't.
>
>That said, after having turned this over in my head now for years, I
>think the only workable solution is going to be defining a new logout
>profile that does something like what you're talking about.  As far as
>I can tell, apps are never going to properly support back-channel
>logout and front-channel is just never going to work consistently.
>
>On Fri, Jun 15, 2012 at 10:22 AM, Steven Carmody
><steven_carmody at brown.edu> wrote:
>> This implementation clearly is NOT the full Logout of all SPs. But, the
>> thinking is that it does provide some value.
>>
>> So, reading Scott's thoughts at the top of this note -- would this be a
>> different profile? Or is this approach "close enough" to the original
>> intent that the standard values could be used ?
>
>-- 
>Chad La Joie
>www.itumi.biz
>trusted identities, delivered
>--
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net