Shiboleth logout problem

[Cantor, Scott]

On 12/13/13, 10:04 AM, "Gruber Bernhard SAI sIT"
<Bernhard.Gruber at s-itsolutions.at> wrote:

>1. The User opens URL of ServiceProvider1 in Browser1 and successfully
>logs in, entering his credentials on shibboleth identity provider.
>2. The User opens URL of ServiceProvider2 in Browser2 and successfully
>logs in, entering the same credentials on shibboleth identity provider.
>Now the User has two distinct IDP-Sessions on the identity provider
>indexed by the same NameID.

No, that depends on the NameID format you use. Transients will be
different for different SPs.

>During debugging, I saw that the first logout removed all indices to the
>first session including the NameID-index.
>During the second logout there was no index to the second session with
>this NameID-index.

If you use a common NameID, yes. I documented that as a limitation in the
wiki, IIRC.

>To me it looks like only one Session can be indexed by a given NameID.
>So if a user logs in independently from different Browsers from different
>Workstations, he will have different sessions on the IDP but only one of
>them is indexed by his NameID.
>And he will only be able to log out form one of these sessions.

Yes. Fixing the limitations of a session cache with many, many problems
and that was not designed to support SAML logout was not a goal, nor
possible in V2.

-- Scott