SP Logout

[Yannick Béot]

I just don't get it.
Why is it a bad idea to use the metadata handler?
How to you pass SP metadata to the IdP?

I do not want to create it by hand!

Y.
On Tue, Sep 11, 2012 at 5:53 PM, Peter Schober
<peter.schober at univie.ac.at>wrote:

> * Yannick Béot <yannick.beot at gmail.com> [2012-09-11 09:09]:
> > Before diving into this back channel, the misuse bothers me.
> > I have read again
> >
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationModel
> >
> > "Each user session is connected to a single application"
> > Since I cannot share the session between the domains, I guess I'll have
> to
> > declare one application/entityID by FQDN even though it is the same
> > application.
>
> Yet another problem. The previous hint was about how you pass metadata
> on to parties that rely on that. Telling them to grab it from the SP's
> handler isn't the recommended approach.
>
> Whether you have one or two "applications" (in Shibboleth config
> terms) is unrelated to the use or non-use of a common vhost or DNS
> domain.
> You can have them both as the "default" applcation and as a single
> EntityDescriptor in metadata (with several ACS URLs for several FQDNs)
> or as seperate EntityDescriptors each with their own metadata.
>
> The former approach with several ACS URLs within the same
> EntityDescriptor has the drawback you noted, which is that only one
> SLO message is being sent to the entity, which won't be sufficient
> to terminate the other domain's session over the front channel.
>
> If they're different SPs to the IDP (seperate EntityDescriptors each
> with their own metadata) the IdP would need to send two SLO messages,
> one for each logical SP.
> -peter
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120911/ba98e346/attachment-0001.html