SP Logout

[Peter Schober]

* Yannick Béot <yannick.beot at gmail.com> [2012-09-11 09:09]:
> Before diving into this back channel, the misuse bothers me.
> I have read again
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationModel
> 
> "Each user session is connected to a single application"
> Since I cannot share the session between the domains, I guess I'll have to
> declare one application/entityID by FQDN even though it is the same
> application.

Yet another problem. The previous hint was about how you pass metadata
on to parties that rely on that. Telling them to grab it from the SP's
handler isn't the recommended approach.

Whether you have one or two "applications" (in Shibboleth config
terms) is unrelated to the use or non-use of a common vhost or DNS
domain.
You can have them both as the "default" applcation and as a single
EntityDescriptor in metadata (with several ACS URLs for several FQDNs)
or as seperate EntityDescriptors each with their own metadata.

The former approach with several ACS URLs within the same
EntityDescriptor has the drawback you noted, which is that only one
SLO message is being sent to the entity, which won't be sufficient
to terminate the other domain's session over the front channel.

If they're different SPs to the IDP (seperate EntityDescriptors each
with their own metadata) the IdP would need to send two SLO messages,
one for each logical SP.
-peter