Backchannel Notify and NameID bound sessions

[Kristof Bajnok]

On 05/03/12 06:11, Harald Strack wrote:
>> My guess is you are confusing SP initiated logout with the response to a
>> SAML logout from an IdP. If the IdP supplies no SessionIndex to the SP,
>> then all sessions associated with the NameID in the LogoutRequest are
>> meant to be terminated, which would fit your observation.
> Yes, you are right. As mentioned here
> 
> https://wiki.aai.niif.hu/index.php/ShibIdpSLO#Session_indexing
> 
> the IdP uses the name identifier value to index the session.
> Additionally there seems to be no way to configure the IdP to send the
> SessionIndex.
> 
> However, this flow ends up in only one deleted IdP session and all
> deleted SP-Sessions that share the same NameID. Thus, a user is only
> logged out from IdP and SP on the client / browser where he initiated
> the logut. On all other clients / browsers only the SP session has been
> deleted but the IdP session is still alive and the user will be SSO'ed
> again. This may confuse our users... 
>
> Is there a way to either 
> 
> 1 tell the IdP to delete all sessions for a given NameID on Logout?

No, I think it's currently not possible by the current SLO
implementation, though I haven't looked up the code. Because the v2 SLO
patch is not actively maintained (it's just updated for the upcoming IdP
releases), it won't be fixed until at least IdPv3.

The problem is that currently it's not possible to clear _all_ IdP
sessions at the IdP. Still I'm wondering how the process should be done.
How can one user's IdP sessions be bound together? I suspect, the
principal name might be different across sessions (it's bound to the
authentication), but is there any other key for this purpose? Will this
be possible with v3?

Adam Lantos has been playing with it while experimenting with
administrative logout, but as far as I can remember, this was the main
point he didn't go on too far.

> 2 tell the SP to contact the IdP again (back channel?) whenever SP sessions getting this way?

It's not allowed by the SAML specification.

Kristof