SP Logout

[Cantor, Scott]

On 9/10/12 3:38 PM, "Yannick Béot" <yannick.beot at gmail.com> wrote:
>
>In order to make it works, I have modified the metadata part in my
>shibboleth2.xml:
>            <Handler type="MetadataGenerator" Location="/Metadata.xml"
>signing="false">
>            
><EndpointBase>https://www.domain.com/Shibboleth.sso</EndpointBase>
>            
><EndpointBase>https://www.domain.org/Shibboleth.sso</EndpointBase>
>            </Handler>

That has nothing to do with making it work. Nothing should ever read that
metadata directly or be dependent on it. That is for testing and example
use only. You have no capability for key rollover if you tie your
configuration directly to the metadata you give to peers.

This has nothing to do with your question, but I don't see how else to
convince people this is wrong but to continually point it out in every
thread where I see a misuse of the feature.

>Is there a way to make this configuration, 2 domains/1 entityID, works?

Not over the front channel, no. Back channel it should work.

>Is there a way that Shibboleth destroys the corresponding session of the
>LogoutRequest, session pointed out by a random Id and a principal,
>wihtout throwing an error?

Yes, with a back channel logout, it works like that. I did not have time
to work on enhancing the front channel to support it.

-- Scott