Logout with new shibboleth sp

[Peter Schober]

* Justin Russo <justin9 at ymail.com> [2013-07-05 18:14]:
> I read the article and i contacted my idp and got the logout url. 
> https://myidp.org/siteminderagent/smlogout.asp?AppReturnUrl=https://mysite.com/mysite/.
> 
> so when i click the logout i go to my idp apge where it states that
> you have successfully logged out and a  label appears with the
> option "click here to navigate back to the site",

What "logout" to you "click" exactly? The URL presented above? Or some
logout link of your application that redirects to /Shibboleth.sso/Logout?

Does the SAML metadata for this IdP have SingleLogoutService elements
defined?
Does the IdP have SingleLogoutService bindings for your SP configured
(via whatever method, probably some GUI or
import-SAML-metadata-from-URL thing)?

If you're not starting the logout at your SP you could check your logs
(possibly changing the level to DEBUG) and watch for logout requests
from the IdP while performing logout.

> Once i click this this takes me to my url
> - https://mysite.com/mysite/ i mentioned in the "return", but the
> problem is it goes directly and doesnt ask me to re-authenticate.  i
> directly go to my app without authenticating.

Can you verify you can't access your application directly after
initiating logout (and before doing anything on the IdP)?
-peter