[refeds] SAML Logout -- giving users options .....

Wed Sep 12 08:55:24 EDT 2012

Hi David,

Yes, a logout button would be nice.
In fact: my browser already have one: on my Mac it's a round red button in the left corner. On windows I think it is a cross in the upper right one :-)

Joking aside: we have been advocating "close your browser" as the only reliable way to completely logout from SURFfederatie from day 1.
I'd love to have a logout button in the browser - maybe a Firefox plugin, but the funny thing is that this button typically appears right next to the "close" button - which does essentially the same thing.
--
Joost

On Sep 12, 2012, at 1:38 PM, David Simonsen <david at wayf.dk> wrote:

> Hello all,
> 
> here is an idea for a different approach, suggested by Mads Freek at WAYF:
> 
> Browsers should implement a button in the UI which simply kills all living sessions created during the time this browser instance has been running.
> 
> It would require acceptance of a new cookie naming schema, also covering http authentications. Perhaps something like this_session_XYZ for session cookie, which should be specified somewhere (perhaps as a REFEDs RFC?).
> 
> And certainly it would require the large browsers to implement the button. This could be achieved following various strategies - so lets focus on the concept itself and what you think about it.
> 
> Once accepted, distribution of new browsers would happen fast with the high update frequency that most browsers operate with these days.
> 
> If you like the idea, we will start drafting the specification.
> 
> Best regards
> David and Mads
> 
> 
> 
> On Sep 12, 2012, at 10:55 , Mohacsi Janos wrote:
>> Dear All,
>> 	Hungarian NREN also did some work for SLO for Shibboleth.
>> https://wiki.aai.niif.hu/index.php/ShibIdpSLO
>> 
>> I think it is definitely worth a discussion on the next REFEDS meeting.
>> 
>> Best Regards,
>> 
>> Janos Mohacsi
>> Head of HBONE+ project
>> Network Engineer, Director Network and Multimedia
>> NIIF/HUNGARNET, HUNGARY
>> Co-chair of Hungarian IPv6 Forum
>> Key 70EF9882: DEC2 C685 1ED4 C95A 145F  4300 6F64 7B00 70EF 9882
>> 
>> On Wed, 12 Sep 2012, Anders Lund wrote:
>> 
>>>> On Sep 11, 2012, at 4:14 PM, "Steven Carmody" <Steven_Carmody at brown.edu> wrote:
>>>> 
>>>>> I think we're all familiar with the the issues associated with the SAML
>>>>> Logout mechanism. They have been discussed for years, and there's a page
>>>>> on the Shib wiki that does a good job of describing the potential problems.
>>>>> 
>>>>> Given all of that discussion, tho, Brown (like other schools, I'll
>>>>> guess) is seeing pressure to "do something better". Better seems to mean:
>>>>> 
>>>>> 1) Applications could display a Logout button. When a user clicks that
>>>>> button, the local Application session is destroyed, and the local
>>>>> Shibboleth session is destroyed.
>>>>> 
>>>>> 2) In addition, the Application could request that the Shib SP redirect
>>>>> the user to a specific url at the IDP associated with the Shib session.
>>>>> This endpoint could do some combination of actions:
>>>>> 
>>>>> a) tell the user to quit their browser (no longer a good idea with
>>>>> Firefox...). Don't do anything further ....
>>>>> 
>>>>> b) destroy the IDP session. The user will have to re-authenticate the
>>>>> next time they attempt to access a Shib-protected application. We are
>>>>> now doing this for some Applications (eg our HR system).
>>>>> 
>>>>> c) Ask the user whether or not they want to destroy the IDP session.
>>>>> 
>>>>> This last option appeals to me, but no one here has yet developed a
>>>>> design or text that could help a "regular user" make an informed decision.
>>>>> 
>>>>> So -- does anyone have a page that implements option c) that they are
>>>>> willing to share ?
>>>>> 
>>>>> Thanks in advance!
>>> 
>>> This is perhaps a bit off topic for the Shib Users list, but
>>> simpleSAMLphp has implemented something you might have a look at.
>>> 
>>> This is used in the Norwegian federation "Feide" (www.feide.no). It
>>> looks something like this:
>>> 
>>> * user is logged in to multiple service providers and choose to log out
>>> from one of them, result is that SLO is triggered and user is
>>> presented a page at the IdP with information about this process.
>>> Example of the look of this page can be found here:
>>> 
>>> http://www.lunders-and.no/clippings/lon120912091253.png
>>> 
>>> Logout started from service provider "TCS Personal Certificate
>>> Portal".
>>> 
>>> * user can select that he/she only want to log out from the service
>>> logout was started from (but killing SSO). In the example from the
>>> screenshot this was chosen, and a new logout from another service give
>>> this logout window again. Screenshot from this, when new logout is
>>> started from service "Foodle":
>>> 
>>> http://www.lunders-and.no/clippings/lon120912091307.png
>>> 
>>> * when "Yes, all services" is selected user is logged out from all
>>> services, using HTTP Redirect binding. While this is done user is
>>> shown a "spinning icon" and finally a green icon to indicate finished
>>> logout:
>>> 
>>> http://www.lunders-and.no/clippings/lon120912091344.png
>>> 
>>> - Anders
>>> 
>>> -- 
>>> Anders Lund <anders.lund at uninett.no>             .~.
>>> UNINETT, N-7465 Trondheim, Norway               / V \
>>> Phone: +47 73 55 79 08 | Mob: +47 93 03 41 26  /(   )\
>>>                                                ^ ^
>>> 
>>> 
> 
> 