[refeds] Re: SAML Logout -- giving users options .....

[Anders Lund]

> On Sep 11, 2012, at 4:14 PM, "Steven Carmody" <Steven_Carmody at brown.edu> wrote:
> 
>> I think we're all familiar with the the issues associated with the SAML 
>> Logout mechanism. They have been discussed for years, and there's a page 
>> on the Shib wiki that does a good job of describing the potential problems.
>>
>> Given all of that discussion, tho, Brown (like other schools, I'll 
>> guess) is seeing pressure to "do something better". Better seems to mean:
>>
>> 1) Applications could display a Logout button. When a user clicks that 
>> button, the local Application session is destroyed, and the local 
>> Shibboleth session is destroyed.
>>
>> 2) In addition, the Application could request that the Shib SP redirect 
>> the user to a specific url at the IDP associated with the Shib session. 
>> This endpoint could do some combination of actions:
>>
>> a) tell the user to quit their browser (no longer a good idea with 
>> Firefox...). Don't do anything further ....
>>
>> b) destroy the IDP session. The user will have to re-authenticate the 
>> next time they attempt to access a Shib-protected application. We are 
>> now doing this for some Applications (eg our HR system).
>>
>> c) Ask the user whether or not they want to destroy the IDP session.
>>
>> This last option appeals to me, but no one here has yet developed a 
>> design or text that could help a "regular user" make an informed decision.
>>
>> So -- does anyone have a page that implements option c) that they are 
>> willing to share ?
>>
>> Thanks in advance!

This is perhaps a bit off topic for the Shib Users list, but
simpleSAMLphp has implemented something you might have a look at.

This is used in the Norwegian federation "Feide" (www.feide.no). It
looks something like this:

* user is logged in to multiple service providers and choose to log out
  from one of them, result is that SLO is triggered and user is
  presented a page at the IdP with information about this process.
  Example of the look of this page can be found here:

  http://www.lunders-and.no/clippings/lon120912091253.png

  Logout started from service provider "TCS Personal Certificate
  Portal".

* user can select that he/she only want to log out from the service
  logout was started from (but killing SSO). In the example from the
  screenshot this was chosen, and a new logout from another service give
  this logout window again. Screenshot from this, when new logout is
  started from service "Foodle":

  http://www.lunders-and.no/clippings/lon120912091307.png

* when "Yes, all services" is selected user is logged out from all
  services, using HTTP Redirect binding. While this is done user is
  shown a "spinning icon" and finally a green icon to indicate finished
  logout:

  http://www.lunders-and.no/clippings/lon120912091344.png

- Anders

-- 
 Anders Lund <anders.lund at uninett.no>             .~.
 UNINETT, N-7465 Trondheim, Norway               / V \
 Phone: +47 73 55 79 08 | Mob: +47 93 03 41 26  /(   )\
                                                  ^ ^