Question related to "Local Logout" provided by Shibboleth IdP 2.4.0

[Yaowen Tu]

That's a really good news to me. I am using principalName as the NameID.

Now the issue I am seeing is that if the same user login to two browsers,
in the second browser, he cannot logout correctly, while in the first
browser, it works.

If I switch to transient ID, will this issue be resolved?

Yaowen


Yaowen


On Thu, Aug 29, 2013 at 3:42 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 8/29/13 6:34 PM, "Yaowen Tu" <yaowen.tu at gmail.com> wrote:
>
> >Actually I am using non-transient NameID.Does it make any difference
> >during single logout compared with transient NameID?
>
> The session cache has design limitations (call them bugs) that cause it to
> overwrite the NameID->SP mapping of the first SP with the second (and so
> on).
>
> It was not designed with logout in mind, and isn't compatible with the
> requirements that correctly implementing the protocol would take. Not that
> the protocol isn't a mess, it is, but given how it works, you have to have
> a perfect record of the NameID issued to every SP.
>
> With a transient, the mappings don't overlap.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130829/5b4f0edb/attachment.html