IDP and High Availability clarifications.

[Nate Klingenstein]

> I guess you mean the fact that because we do not keep track of user cookies we can't really do anything about log out however the SP should still be able to show a "log out"  link which simply expires the cookie at the user browser, no?


Yes.  You don't have the ability to do single logout or administrative(forced) logout, though.

> Yeah thats what I thought though your answer is kind of conflicting with Nate's answer.


Not really, though Scott's answer is more precise.  It doesn't replace the idp_session cookie, but it can play a similar role.  It's the _idp_authn_lc_key cookie that can't have its behavior replicated, which necessitates some amount of session stickiness through the login process.