Questions about SLO support in IdP 2.4.0

[Cantor, Scott]

On 4/19/13 4:07 PM, "Yaowen Tu" <yaowen.tu at gmail.com> wrote:
>
>1. Just to double confirm that IdP will terminate the session associated
>with the SP that send the logout request, and leave other SPs unchanged.
>How about the following scenario:
>
>          a. In one browser, I logged in as user1 for SP1 and SP2.
>
>          b. I click logout from SP1. New user1 in SP1 is logged out, but
>user1 in SP2 still loggs in, right?

If a session exists between user1 and SP2, it will still exist. That's all
I can say.

>          c. What if I try to access SP1 in the same browser, will IdP
>prompt login screen? I guess yes, then can I login as a different user
>same user2 for SP1?

Once the IdP logout is done, all requests to the IdP will result in
whatever it is configured to do when no session exists.

The usual screwy behavior in which it combines user identities in one
session and ends up randomly picking one doesn't apply because the session
with the original user identity is gone at the IdP. Whatever you login as
will become the user identity for any subsequent SPs until something else
happens. You can certainly end up with sessions at 10 SPs with 10
different user identities given enough logouts and enough passwords.

>          d. In the end, in one browser, user2 logged in SP1, and user2
>logged in SP2, is that correct?

I don't think that's the scenario you're intending to suggest.

>2. In Local logout section, I see "a direct non-SAML request", can you
>tell me what kind of request is that?

GET /idp/profile/LocalLogout


That's it.

>3. I am still not very clear what's different between Local and SAML
>logout in terms of session management on IdP side, I know that in SAML
>logout, it will terminate the session associated with this SP, and how
>about Local logout? I see "the IdP locates an
> active session based on the client's cookie and terminates it.", but
>what are the differences between these two sessions?

There may be no difference. In one case, it looks up the session in the
cache based on the LogoutRequest message and in the other case it looks up
the session in the cache based on the client cookie.

Consider what happens in a frame or something if the cookie doesn't show
up at the IdP. One of those might still do something, and one of them
can't do anything.

-- Scott