Asynchronous Logout with ADFS

[Cantor, Scott]

On 4/2/13 8:36 AM, "bmontgomery" <bmontgomery at teamdynamix.com> wrote:

>We have the Shib SP running on IIS, and we're trying to integrate the
>logout
>functionality with ADFS. I've seen plenty of things out there (including
>Shibboleth SP docs) which say that ADFS does not like the extensions
>(which
>define asynchronous logout) that are put into the XML of the logout
>request,
>and it throws an error when the user is redirected to ADFS from Shib. I'm
>of
>the opinion that this is a Microsoft bug, but MS seems to think otherwise.

MS is wrong. Extensions in SAML are optional by definition. This is
explicitly called out in the standard. This is not just opinion, as it's
not an ambiguous area of the standard.

> 
>
>>From what I'm reading, I can just put asynchronous="false" on the
>LogoutInitiator element to work around this problem. I'm wondering if that
>is the right thing to do. What effect does this have on Shib IdP's (and
>other IdP's) which integrate with us?

The only software that will ever do anything with that extension is a
Shibboleth IdP version that isn't out yet.

-- Scott