Question related to "Local Logout" provided by Shibboleth IdP 2.4.0

[Cantor, Scott]

On 8/29/13 6:34 PM, "Yaowen Tu" <yaowen.tu at gmail.com> wrote:

>Actually I am using non-transient NameID.Does it make any difference
>during single logout compared with transient NameID?

The session cache has design limitations (call them bugs) that cause it to
overwrite the NameID->SP mapping of the first SP with the second (and so
on).

It was not designed with logout in mind, and isn't compatible with the
requirements that correctly implementing the protocol would take. Not that
the protocol isn't a mess, it is, but given how it works, you have to have
a perfect record of the NameID issued to every SP.

With a transient, the mappings don't overlap.

-- Scott