SP Logout

[Yannick Béot]

Before diving into this back channel, the misuse bothers me.
I have read again
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationModel


"Each user session is connected to a single application"
Since I cannot share the session between the domains, I guess I'll have to
declare one application/entityID by FQDN even though it is the same
application.

It will resolve my logout problems.


Yannick


On Tue, Sep 11, 2012 at 1:59 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 9/10/12 3:38 PM, "Yannick Béot" <yannick.beot at gmail.com> wrote:
> >
> >In order to make it works, I have modified the metadata part in my
> >shibboleth2.xml:
> >            <Handler type="MetadataGenerator" Location="/Metadata.xml"
> >signing="false">
> >
> ><EndpointBase>https://www.domain.com/Shibboleth.sso</EndpointBase>
> >
> ><EndpointBase>https://www.domain.org/Shibboleth.sso</EndpointBase>
> >            </Handler>
>
> That has nothing to do with making it work. Nothing should ever read that
> metadata directly or be dependent on it. That is for testing and example
> use only. You have no capability for key rollover if you tie your
> configuration directly to the metadata you give to peers.
>
> This has nothing to do with your question, but I don't see how else to
> convince people this is wrong but to continually point it out in every
> thread where I see a misuse of the feature.
>
> >Is there a way to make this configuration, 2 domains/1 entityID, works?
>
> Not over the front channel, no. Back channel it should work.
>
> >Is there a way that Shibboleth destroys the corresponding session of the
> >LogoutRequest, session pointed out by a random Id and a principal,
> >wihtout throwing an error?
>
> Yes, with a back channel logout, it works like that. I did not have time
> to work on enhancing the front channel to support it.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120911/394073a4/attachment-0001.html