Logout with new shibboleth sp

[Peter Schober]

* Justin Russo <justin9 at ymail.com> [2013-07-05 19:35]:
> Hi Peter thank you soo much.
> I did verify the metadata file provided by my IDP and there is no SingleLogoutService defined.
> all they gave me is the https://myidp.org/siteminderagent/smlogout.asp?AppReturnUrl=https://mysite.com/mysite/ to logout
> so can i still achieve the logout from my end (sp).

Assuming the software does support SAML2 logout (a quick search on the
web suggests it does) you should rather talk to the IdP and ask them
about their SAML2 logout endpoint and bindings (which you would then
add to your copy of their metadata).

Failing that you could initiate logout from your application by
placing a link to your logout handler /Shibboleth.sso/Logout with a
'return' query string that contains the above URL in urlencoded form.

Something like this:

/Shibboleth.sso/Logout?return=https%3A%2F%2Fmyidp.org%2Fsiteminderagent%2Fsmlogout.asp%3FAppReturnUrl%3Dhttps%3A%2F%2Fmysite.com%2Fmysite%2F

That should initiate local logout at your SP and may (or may not, no
way for me to know) kill your session at the IdP (preventing immediate
SSO into your application).

The problem with that approach then remains (cf. the wiki page I
pointed you to) that a similar or identical process at any other SP
usable from this IdP will leave your SP stranded with a session and no
logout. Meaning a user of your and some other SP initiating logout
this way at the other SP would leave an active session in your SP.

But since you've said you read the SLOIssues page I suppose you
already knew that.
-peter