It's posible IDP initialized Single Logout
Peter Schober
peter.schober at univie.ac.at
Fri Jul 12 07:01:33 EDT 2013
* david.tello <david.tello at whitebearsolutions.com> [2013-07-12 12:56]:
> I have a doubt, i read that to make a IDP initialized Logout is posible in
> shibboleth and that it's not posible make it.
The IdP does not support single logout, IdP-initiated or otherwise:
https://wiki.shibboleth.net/confluence/display/SHIB2/SLOIssues
> If it's not posible, someone give me any idea to resolve this problem?
>
> I have two SPs and one IDP, and when one SP make logout, the session
> die in the requested SP and the IDP, but the other SP still having
> his active session.
You would need support for single logout in the IdP for that to work.
The above page describes what else you'd need.
Granted with only two SPs both of which you control (I'm assuming)
that's not really the problem (except for missing support in the Shib
IdP). But likely sooner or later you'll add another SP which does not
support SLO (and which you don't control, e.g. an outsoured service)
and then you're stuck with a broken logout solution just the same.
-peter
More information about the users
mailing list