shibboleth SP logout question

[Sam Jacob]

after SP's   "Shibboleth.sso/Logout", does the user have to close the
browser to enforce a logout?


On Thu, Apr 25, 2013 at 9:04 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 4/25/13 9:52 AM, "Sam Jacob" <skjacob at gmail.com> wrote:
>
> >we implemented the Shibboleth.sso/Logoutbut have a question:
> >1. user logs out of SP application and calls Shibboleth.sso/Logout
> >2. then user logs out of the single-sign on ,ie. iDP logout
> >3. close the browser
> > Can the user still access the SP application if logged out of iDP?
>
> Not if the steps you list are followed, but there are no details behind
> those steps. There is no standard for "logout of IdP" so unless you're
> doing a SAML logout or something, I don't know what you specifically refer
> to.
>
> > if the user can still access the SP application without logging into iDP
> >(after iDP logout) ,
> > what will be the reason for that ?
>
> There's no way for me to answer that. You have logs, and a client you can
> trace the requests from, so I'd suggest you start there.
>
> >does SP has any control on the iDP session , or is it iDP's
> >responsibility to expire or remove
> > the cookie on iDP logout?
>
> The SP has no control over the IdP's session, nor could it. It can send
> SAML logout requests, or issue proprietary redirects.
>
> Running the logout handler is not one thing. It's a trigger for a set of
> behaviors you configure in the SP, so what happens is up to you and the
> capabilities of the IdP.
>
> And after all that, you may have an application session to deal with.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
Sam Jacob
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130425/1b1ed49b/attachment.html