Verständnisfrage zur Reihenfolge beim Logout

[Peter Schober]

* Martin Lunze <martin.lunze at tu-dresden.de> [2013-08-01 11:40]:
> > (My) Short version: If you control all the SPs your IdP will ever
> > federate with (and have an IdP that supports SLO) you can very likely
> > make SLO work reliably. Then you add another SP management cars about
> > (which of course does not support SLO) and your "single" logout breaks
> > down.
> 
> Principally we want to connect local SP, which are located at our
> university, to our IdP and therefor we require they implement the SLO
> like we want.

No services from your local identity federation (which you mentioned
below) or beyond (e.g. via eduGAIN), /ever/?
Unless you're sure you will never have federated SPs (which by
defnition you can't control and by experience don't support SLO) some
think it's pointless (or worse, harmful) to offer logout when it will
not do what people naively expect it to do (i.e., log them out
everywhere).

> Okay. The most important point for us is, that the session on the
> side of IdP will be closed, so that if people leave their workplace
> and don't lock their computers, nobody else can hack "all" SP which
> are connected to our IdP.
> 
> I think therefor it should be good enough.

Right, only "All SPs accessed (potentially minus the last one,
initating the logout request)".
Also note that people at your institution may also have differing
views on what is good enough, once they fully understand the
situation. Maybe not, YMMV.

> > Just out of curiosity: How exactly would you expect an average
> > computer user to do that, log out from those other SPs? Based on
> > the entityIds of those SPs (or display names, if you changed
> > logout.jsp sufficiently)?
> 
> At the moment i show them only a message at the logout.jsp explaining,
> they are logged out from IdP but could be logged in in other SP.
> Then i list all entityIds of the SP's the user has logged in during his
> last session and tell him to check if all sessions are closed or not.

Note that you merely described what the 2.4 IdP does (out of the box)
instaed of answering my question: How does Professor Veryimportant (or
her secretary) manually log out of any of those SPs, given a list of
entityIDs? `apt-get install handwavium`?

> I am waiting for shibboleth 3 and maybe sometime there will be a
> rule in the dfn-aai which requires that everybody has to include SLO
> :)

IdP v3 will /not/ come with SLO. But it might allow extensions like
the NIIF SLO one to work (better), if such get written (again).

Also (ignoring the smilely) such a rule (an identity federation
requiring SLO support in all IDPs and SPs) is nonsensical of course,
as it would just mean a federation without (m)any IdPs and
SPs, leaving the real need for federation unaddressed.
-peter