specifying logout endpojnt at the IDP

[Curry, Warren]

For these walk in cases, on library based equipment.   There can be mechanisms to force the browser to be closed and thus also end the session.       If the browser is ended would that not end the session for that user??? 

Again this is a limited case to the workstation managed by and located in the library.   

The browser available is controlled, etc...  

Warren 

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Steven Carmody
Sent: Friday, June 15, 2012 11:17 AM
To: users at shibboleth.net
Subject: Re: specifying logout endpojnt at the IDP

On 6/15/12 10:33 AM, Paul Hethmon wrote:
>  I also make available what I call a simple logout page as well. That 
> simple page just kills the IdP session. I don't try to publish it in 
> the metadata, I just tell the RP's that they can use that if they 
> don't want to do SLO. Many of them do have a configuration point in 
> their application to send a user to a certain URL at the end of their 
> logout process.
>

that approach works -- unless the SP accepts many IDPs, and would have to (somehow) obtain the Logout endpoint for the IDP associated with the current session.... if the SP uses Shib (which doesn't support having the SP admin enter the IDPs Logout url via a wizard)... then I'm immediately led back to thinking about how the SP could leverage metadata in order to find the IDPs Logout endpoint .....

Currently, my app can present a Logout button; when the user clicks the button I can redirect to the /Shibboleth.sso/Logout local endpoint to destroy the Shib session. I can add a parameter to that url (pointing to the IDP/Logout endpoint) and the SP, when finished, will redirect the user to that location (thus doing IDP Logout).

My next thought, tho, is that the app can easily redirect to a standard endpoint at the SP (/Shibboleth.sso/Logout ). But, it would have to go searching thru the metadata in order to find the appropriate IDP Logout endpoint. Is there an easier way to do this, without requiring that the app inspect the endpoint?

perhaps this is an RFE... asking if the SP could provide a second /Logout endpoint... one that would also redirect to the IDP, if it has a Logout endpoint ....
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net