SAML Logout -- giving users options .....

[Peter Schober]

* Steven Carmody <Steven_Carmody at brown.edu> [2012-09-11 22:14]:
> Given all of that discussion, tho, Brown (like other schools, I'll 
> guess) is seeing pressure to "do something better". Better seems to mean:

Whether that is in fact better is of course very much open to
discussion.

We do have something like 2c) but central IT has recently published a
policy (one of the first policies ever from central IT; we don't even
have a password policy!) which basically states that (jfyi):
- All university web systems should (lower case "should") be
  integrated with the web sso system; that's a NOOP, IMO.
- When apps accept SAML for logins there should be no logout button,
  if possible. Otherwise it should lead to an explanation of how to
  safely close the browser.
- Account switching should be handled in the application, if possible.

> So -- does anyone have a page that implements option c) that they
> are willing to share ?

We still do offer to optionally nuke the IdP's cookie, at
https://weblogin.univie.ac.at/logout/
(spectacular, I know ;)
but that was from a time before the aforementioned policy was created.
The text roughly states:

 "Exit/End Weblogin: If you want to end your whole weblogin session
  please choose [Logout] *and* *completely* *exit* *your* *webbrowser*,
  e.g. with File -> Quit.
  (Alternatively/But) You can also continue your weblogin session and
  access further applications."

Note that when REMOTE_ADDR is matching a specific IP range (library
computer labs) you're /not/ given the above choice and the IdP's
session cookie is destroyed right away at this URL. The text then
changes to inform you that whwn leaving the terminal/computer you MUST
close your browser to fully quit your weblogin session with all
applications. (This had been requested by the university library
folks. In case you'd wanted top continue there are two
library-specific links being presented as starting points.)

None of the above is meant to be some kind of BCP, of course.
-peter