Backchannel Notify and NameID bound sessions

[Cantor, Scott]

On 3/3/12 8:47 AM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

>On 3/3/12 1:58 AM, "Harald Strack" <hstrack at ssystems.de> wrote:
>>No, it doesn't send only on one single session. Actually it sends as
>>much sessions as the user owns on this SP, here the SOAP Request from
>>shibd.log (13 Sessions):
>
>I would have to dig into the code to determine what it was supposed to do.
>That might be right or wrong, I don't know. I'm headed out on vacation, so
>I'll get into when I get back if you file a bug. The behavior should at
>least be documented.

I took a quick look before I fly out...it does not appear to trigger
notification based on all the sessions bound to a NameID when you initiate
logout at the SP. It sends a notification based on an array of size 1 with
just the session associated with the client.

My guess is you are confusing SP initiated logout with the response to a
SAML logout from an IdP. If the IdP supplies no SessionIndex to the SP,
then all sessions associated with the NameID in the LogoutRequest are
meant to be terminated, which would fit your observation.

-- Scott