Shibboleth IdP SLO and return URL not working

[Nate Klingenstein]

Gary,

I think the thing that "broke" is actually now "unbroken".

The SP had been performing a local logout only because a SAML logout service was not enumerated in the IdP's metadata.  The SP thus had the final redirect and could send the user to http://somewebsite.com.

Now that the IdP can perform SAML logout, the user ends up at the IdP after the SAML logout process happens and the SP never gets a chance to directly redirect the user to http://somewebsite.com itself.

I think your best option is to customize logout.jsp at the IdP so that it performs the redirect to the desired site itself after both the SP and IdP sessions are cleared.

Hope I got this right -- not much hands on experience with the new logout stuff yet.
Nate.

On Dec 12, 2013, at 9:59 AM, "Lipscomb, Gary" <glipscomb at csu.edu.au<mailto:glipscomb at csu.edu.au>>
 wrote:

We have upgraded our IdP from 2.3.5 to 2.4.0 and previously our service provider could use the following URL to redirect the user to another site after logout

/Shibboleth.sso/Logout?return=http://somewebsite.com<http://somewebsite.com/>

This  no longer works and the user remains at the IdP logout page logout.jsp

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131212/a9c654fc/attachment.html