Single log out across all service providers

[Brian Reindel]

Okay, so let me focus in on this:

>>* Although the session is gone, I can still hit the application, and I
>>am not being redirected to my configured login handler as if there
>>were no session.
>
> Well, that issue would be on you. A local logout issue with the
> application is simply an illustration of the general problem.

If I hit /Shibboleth.sso/Logout in my service provider, and it kills
the session appropriately, then when I hit that particular service
provider again should I be prompted to login again as if I had not
logged in at all (if it is working)?

Also, I understand sometimes that documentation can be painstaking to
update, but it may be worth updating the wiki page I referenced with
an external reference to this page by the University of Texas:

http://www.utexas.edu/its/help/shibboleth/2299

It is extremely clear, and provides a better summation of the problem at hand.


On Tue, Aug 20, 2013 at 2:57 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 8/20/13 2:41 PM, "Brian Reindel" <brian at reindel.com> wrote:
>
>>Maybe I'm just not understanding how the single log out should work,
>>but I am following the flow here:
>>https://wiki.shibboleth.net/confluence/display/SHIB2/IdPEnableSLO
>
> If you read the introduction text, it is explicit that we did not
> implement single logout, nor will we until a lot of code is revamped to
> accomodate terminating a session without access to a cookie, and even then
> it will work poorly, so there is little point.
>
>>* Shibboleth is only killing the session for the SP that hit
>>/Shibboleth.sso/Logout (as indicated in the verbiage of the logout.jsp
>>on the IdP), but it does not kill the session on the other SPs.
>
> Which is exactly what's documented.
>
>
>>* Although the session is gone, I can still hit the application, and I
>>am not being redirected to my configured login handler as if there
>>were no session.
>
> Well, that issue would be on you. A local logout issue with the
> application is simply an illustration of the general problem.
>
>>I get that my applications may have their own session management that
>>I need to deal with in some way, but my desired functionality is to
>>have an SP initiate a logout, and it kills the Shibboleth session for
>>that user on all SPs. If I then try and hit any SP I have to log back
>>in.
>
> And that is not what we support.
>
>>Is that just stating the obvious that if the session management was
>>customized then the logout might not work as intended? If so, then I
>>don't need to worry about that.
>
> No, it's an example page demonstrating some APIs reporting the SPs that
> will not be affected by the logout.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net