How to avoid failure of SLO
Peter Schober
peter.schober at univie.ac.at
Tue May 8 09:55:43 BST 2012
* shibbolethe <shibbolethe at 126.com> [2012-05-08 04:04]:
> if any IdP or SP in the SLO does not respond, the HTTP Redirect SLO
> sequence might fail, leaving active sessions at some SPs.
> How to avoid this situation? Replace HTTP redirect binding with another ?
> Any advice would be appreciated ,thanks
Other bindings have other drawbacks, e.g. the backchannel requires
applications integrate with SAML in a way that they can terminate a
subject's session without the browser being present (i.e., without
access to the session cookie). That's not how the vast majority of
application integrations are done today.
But that's all explained in the documentation (SLOIssues).
-peter
More information about the users
mailing list