SAML Logout -- giving users options .....

[Steven Carmody]

I think we're all familiar with the the issues associated with the SAML 
Logout mechanism. They have been discussed for years, and there's a page 
on the Shib wiki that does a good job of describing the potential problems.

Given all of that discussion, tho, Brown (like other schools, I'll 
guess) is seeing pressure to "do something better". Better seems to mean:

1) Applications could display a Logout button. When a user clicks that 
button, the local Application session is destroyed, and the local 
Shibboleth session is destroyed.

2) In addition, the Application could request that the Shib SP redirect 
the user to a specific url at the IDP associated with the Shib session. 
This endpoint could do some combination of actions:

a) tell the user to quit their browser (no longer a good idea with 
Firefox...). Don't do anything further ....

b) destroy the IDP session. The user will have to re-authenticate the 
next time they attempt to access a Shib-protected application. We are 
now doing this for some Applications (eg our HR system).

c) Ask the user whether or not they want to destroy the IDP session.

This last option appeals to me, but no one here has yet developed a 
design or text that could help a "regular user" make an informed decision.

So -- does anyone have a page that implements option c) that they are 
willing to share ?

Thanks in advance!