Question related to "Local Logout" provided by Shibboleth IdP 2.4.0

[Cantor, Scott]

On 8/28/13 10:03 PM, "Yaowen Tu" <yaowen.tu at gmail.com> wrote:
>
>It looks like the SAML Logout implemented in IdP 2.4.0 won't work if the
>same user login on multiple browser.

We would be happy to hear how you think that's implementable on the dev
list for future evaluation.

>I am trying to implement "Local Logout". The wiki says that local logout
>will stop in IdP side and show logout.jsp. We can customize this jsp
>page. Is it possible to ask IdP to come back to SP side or come back to
>the URL specified in RelayState after local logout instead of showing
>logout.jsp?

To come back to the SP, just turn off the asynchronous flag.

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPLogoutInitiato
r

Otherwise your logout.jsp can read parameters and do any redirects it
wants to do itself. Once it's in control, the IdP is done with the process.

>BTW, is there any plan to improve the single logout flow some how in next
>releases?

There is no commitment to do anything else with logout because none of the
technical challenges associated with it have been solved. I am not going
to see us ship something that depends on third-party cookies, which means
logout will only work with systems that support back channel requests or
that can terminate front channel sessions without access to a cookie.
There are very few complex apps that meet either requirement.

I realize there are people who think logout is a practical idea. None of
them have, to my knowledge, ever worked directly with the project on
implementing it. Ultimately for something to be implemented, it ought to
be done by people with a belief in the concept and an understanding of, in
their mind at least, what's necessary to do it.

-- Scott