Single log out across all service providers

[Brian Reindel]

I have a better handle on this now after reviewing some more of the
documentation, and what you sent. My previous problem with not being
prompted to login after initiating the logout was a configuration
issue on my end.

We actually don't need to implement any front-channel or back-channel
notifications for internal application session management because our
IdP and all of our SPs are in the same security domain. We're going to
end up deleting all domain cookies from the identity provider, which
will in turn kill all sessions. I've tested in Firebug by removing all
cookies after login, and it appears to be working.

Considering we're not running a federation (even in our enterprise) I
guess we're lucky. I know this solution would not work for most
people.


On Tue, Aug 20, 2013 at 3:54 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 8/20/13 3:28 PM, "Brian Reindel" <brian at reindel.com> wrote:
>>
>>If I hit /Shibboleth.sso/Logout in my service provider, and it kills
>>the session appropriately, then when I hit that particular service
>>provider again should I be prompted to login again as if I had not
>>logged in at all (if it is working)?
>
> It depends on the protection model you use and how the application and the
> SP are integrated. If you aren't prompted than the likely reason is your
> application isn't relying on the SP session and you haven't built in
> notification or redirect flows integrated with the SP logout function.
>
>>Also, I understand sometimes that documentation can be painstaking to
>>update, but it may be worth updating the wiki page I referenced with
>>an external reference to this page by the University of Texas:
>>
>>http://www.utexas.edu/its/help/shibboleth/2299
>>
>>It is extremely clear, and provides a better summation of the problem at
>>hand.
>
> Feel free to incorporate material or edits you think help, but I would
> rather not link to outside material as a replacement for improving what's
> there. But the page you're looking at on this side is not an explanation
> of SP logout integration issues, let alone the "big picture". It's about
> enabling an IdP feature. The page that discusses the SP end of things is
> probably this one:
>
> https://wiki.shibboleth.net/confluence/display/SHIB2/SLOWebappAdaptation
>
> The real answer is that logout is not the issue anymore, shared machines
> are. And the solution there is to disable SSO for shared machines.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net