SAML Logout -- giving users options .....

[Peter Schober]

So, where to reply with this...

* Joost van Dijk <Joost.vanDijk at surfnet.nl> [2012-09-12 14:56]:
> In fact: my browser already have one: on my Mac it's a round red
> button in the left corner. On windows I think it is a cross in the
> upper right one :-)

Except that closing a window on MacOS never quit the application and
hence leaves it running, with state active, presumably.

> I'd love to have a logout button in the browser - maybe a Firefox
> plugin, but the funny thing is that this button typically appears
> right next to the "close" button - which does essentially the same
> thing.

Except that sometimes it doesn't, cf. Firefox's decision to turn all
session cookies into persistent cookies, even then the user agent was
exited properly (i.e., did not crash). Hence this discussion.

Myself, I find the logout discussion the way it is presented generally
to be much too generic/universal/unspecific. Logout from web apps is
not a problem on my workstation at work (or at home). It's not a
problem on my notebook. Or netbook. Or on people's countless "mobile"
devices. Or in my university's computer labs.
Two IMHO valid sub-problems of that are (there may be more):

* Kiosks, internet cafes and others' computers. This becomes less of a
  problem when devices become more personal and 1. are less likely to
  be shared (I would think; no idea really), and 2. always available,
  lessening the need for kisos and internet cafes the first place.
  Also in many of these cases some would recommend not logging in at
  all with an "enterprise" identity.

* Account switching. Again this is not the full scope of the logout
  problem but only for a minorioty of users who regularly need to use
  seperate accounts for work (checking access rights with an
  unpriveledged account in an LMS). Giving those specific instructions
  (use two different HTTP user agents; learn how to use seperate
  sessions or instances of the same user agent, etc.) is possible and
  get's rid of most of that problem. Some applications can be extended
  to integrate "Act as _______" functionality for specific users,
  e.g. Mahara does this very well.

Both of these can be tackled to some degree and IMO quite drastically
change the face of "the logout problem".
-peter