specifying logout endpojnt at the IDP

[Steven Carmody]

On 6/15/12 10:33 AM, Paul Hethmon wrote:
>  I also make available what I call a simple logout page
> as well. That simple page just kills the IdP session. I don't try to
> publish it in the metadata, I just tell the RP's that they can use that if
> they don't want to do SLO. Many of them do have a configuration point in
> their application to send a user to a certain URL at the end of their
> logout process.
>

that approach works -- unless the SP accepts many IDPs, and would have 
to (somehow) obtain the Logout endpoint for the IDP associated with the 
current session.... if the SP uses Shib (which doesn't support having 
the SP admin enter the IDPs Logout url via a wizard)... then I'm 
immediately led back to thinking about how the SP could leverage 
metadata in order to find the IDPs Logout endpoint .....

Currently, my app can present a Logout button; when the user clicks the 
button I can redirect to the /Shibboleth.sso/Logout local endpoint to 
destroy the Shib session. I can add a parameter to that url (pointing to 
the IDP/Logout endpoint) and the SP, when finished, will redirect the 
user to that location (thus doing IDP Logout).

My next thought, tho, is that the app can easily redirect to a standard 
endpoint at the SP (/Shibboleth.sso/Logout ). But, it would have to go 
searching thru the metadata in order to find the appropriate IDP Logout 
endpoint. Is there an easier way to do this, without requiring that the 
app inspect the endpoint?

perhaps this is an RFE... asking if the SP could provide a second 
/Logout endpoint... one that would also redirect to the IDP, if it has a 
Logout endpoint ....