Backchannel Notify and NameID bound sessions

[Harald Strack]

Hi Scott,

-- sorry for sending unfinished messasges, sth. wrong with my email
editor... 

On Sat, 2012-03-03 at 13:53 +0000, Cantor, Scott wrote: 
> On 3/3/12 8:47 AM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
> 
> >On 3/3/12 1:58 AM, "Harald Strack" <hstrack at ssystems.de> wrote:
> >>No, it doesn't send only on one single session. Actually it sends as
> >>much sessions as the user owns on this SP, here the SOAP Request from
> >>shibd.log (13 Sessions):
> >
> >I would have to dig into the code to determine what it was supposed to do.
> >That might be right or wrong, I don't know. I'm headed out on vacation, so
> >I'll get into when I get back if you file a bug. The behavior should at
> >least be documented.
> 
> I took a quick look before I fly out...it does not appear to trigger
> notification based on all the sessions bound to a NameID when you initiate
> logout at the SP. It sends a notification based on an array of size 1 with
> just the session associated with the client.
> 
> My guess is you are confusing SP initiated logout with the response to a
> SAML logout from an IdP. If the IdP supplies no SessionIndex to the SP,
> then all sessions associated with the NameID in the LogoutRequest are
> meant to be terminated, which would fit your observation.
Yes, you are right. As mentioned here

https://wiki.aai.niif.hu/index.php/ShibIdpSLO#Session_indexing

the IdP uses the name identifier value to index the session.
Additionally there seems to be no way to configure the IdP to send the
SessionIndex.

However, this flow ends up in only one deleted IdP session and all
deleted SP-Sessions that share the same NameID. Thus, a user is only
logged out from IdP and SP on the client / browser where he initiated
the logut. On all other clients / browsers only the SP session has been
deleted but the IdP session is still alive and the user will be SSO'ed
again. This may confuse our users... 

Is there a way to either 

1 tell the IdP to delete all sessions for a given NameID on Logout?
2 tell the SP to contact the IdP again (back channel?) whenever SP sessions getting this way?

br & happy holidays

Harald




> 
> -- Scott
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-- 
Harald Strack, Dipl.Inf.(FH)
IT Development

ssystems
c/o todo GmbH
Alt-Moabit 60a
10555 Berlin

Tel:     +49 30 2023 6071 - 1
http://www.ssystems.de

-- 
Harald Strack, Dipl.Inf.(FH)
IT Development

ssystems
c/o todo GmbH
Alt-Moabit 60a
10555 Berlin

Tel:     +49 30 2023 6071 - 1
http://www.ssystems.de