Single log out across all service providers

[Cantor, Scott]

On 8/20/13 2:41 PM, "Brian Reindel" <brian at reindel.com> wrote:

>Maybe I'm just not understanding how the single log out should work,
>but I am following the flow here:
>https://wiki.shibboleth.net/confluence/display/SHIB2/IdPEnableSLO

If you read the introduction text, it is explicit that we did not
implement single logout, nor will we until a lot of code is revamped to
accomodate terminating a session without access to a cookie, and even then
it will work poorly, so there is little point.

>* Shibboleth is only killing the session for the SP that hit
>/Shibboleth.sso/Logout (as indicated in the verbiage of the logout.jsp
>on the IdP), but it does not kill the session on the other SPs.

Which is exactly what's documented.


>* Although the session is gone, I can still hit the application, and I
>am not being redirected to my configured login handler as if there
>were no session.

Well, that issue would be on you. A local logout issue with the
application is simply an illustration of the general problem.

>I get that my applications may have their own session management that
>I need to deal with in some way, but my desired functionality is to
>have an SP initiate a logout, and it kills the Shibboleth session for
>that user on all SPs. If I then try and hit any SP I have to log back
>in.

And that is not what we support.

>Is that just stating the obvious that if the session management was
>customized then the logout might not work as intended? If so, then I
>don't need to worry about that.

No, it's an example page demonstrating some APIs reporting the SPs that
will not be affected by the logout.

-- Scott