Single log out across all service providers

[Cantor, Scott]

On 8/20/13 3:28 PM, "Brian Reindel" <brian at reindel.com> wrote:
>
>If I hit /Shibboleth.sso/Logout in my service provider, and it kills
>the session appropriately, then when I hit that particular service
>provider again should I be prompted to login again as if I had not
>logged in at all (if it is working)?

It depends on the protection model you use and how the application and the
SP are integrated. If you aren't prompted than the likely reason is your
application isn't relying on the SP session and you haven't built in
notification or redirect flows integrated with the SP logout function.

>Also, I understand sometimes that documentation can be painstaking to
>update, but it may be worth updating the wiki page I referenced with
>an external reference to this page by the University of Texas:
>
>http://www.utexas.edu/its/help/shibboleth/2299
>
>It is extremely clear, and provides a better summation of the problem at
>hand.

Feel free to incorporate material or edits you think help, but I would
rather not link to outside material as a replacement for improving what's
there. But the page you're looking at on this side is not an explanation
of SP logout integration issues, let alone the "big picture". It's about
enabling an IdP feature. The page that discusses the SP end of things is
probably this one:

https://wiki.shibboleth.net/confluence/display/SHIB2/SLOWebappAdaptation

The real answer is that logout is not the issue anymore, shared machines
are. And the solution there is to disable SSO for shared machines.

-- Scott