SP Logout

[Cantor, Scott]

On 9/11/12 11:53 AM, "Peter Schober" <peter.schober at univie.ac.at> wrote:
>
>The former approach with several ACS URLs within the same
>EntityDescriptor has the drawback you noted, which is that only one
>SLO message is being sent to the entity, which won't be sufficient
>to terminate the other domain's session over the front channel.
>
>If they're different SPs to the IDP (seperate EntityDescriptors each
>with their own metadata) the IdP would need to send two SLO messages,
>one for each logical SP.

There are several bugs that are really more like design incompatibilities
between SAML logout and the application concept. The latter predates
logout, and it doesn't really work that well with it. There's an open bug
on at least one of the issues related to not getting a second
application's session terminated when the first one is logged out. The IdP
might know about the extra session(s), but it doesn't know which SLO
endpoint to send a request to. And the back channel doesn't fix that
either, so my suggestion was probably wrong.

However, there are tricks you can use like routing local logout return
values to hit other application local logout hooks and so on. It's a mess,
but it's probably possible.

Or the browser vendors could simply add a cookie property called "Authn"
and implement a logout button that clears all Authn cookies and HTTP auth
state.

-- Scott