shibboleth SP logout question

[Cantor, Scott]

On 4/25/13 9:52 AM, "Sam Jacob" <skjacob at gmail.com> wrote:

>we implemented the Shibboleth.sso/Logoutbut have a question:
>1. user logs out of SP application and calls Shibboleth.sso/Logout
>2. then user logs out of the single-sign on ,ie. iDP logout
>3. close the browser
> Can the user still access the SP application if logged out of iDP?

Not if the steps you list are followed, but there are no details behind
those steps. There is no standard for "logout of IdP" so unless you're
doing a SAML logout or something, I don't know what you specifically refer
to.

> if the user can still access the SP application without logging into iDP
>(after iDP logout) ,
> what will be the reason for that ?

There's no way for me to answer that. You have logs, and a client you can
trace the requests from, so I'd suggest you start there.

>does SP has any control on the iDP session , or is it iDP's
>responsibility to expire or remove
> the cookie on iDP logout?

The SP has no control over the IdP's session, nor could it. It can send
SAML logout requests, or issue proprietary redirects.

Running the logout handler is not one thing. It's a trigger for a set of
behaviors you configure in the SP, so what happens is up to you and the
capabilities of the IdP.

And after all that, you may have an application session to deal with.

-- Scott