Overcome SLO problem by setting session lifetime of service to minimum

[Cantor, Scott]

On 7/27/13 7:40 PM, "Misc" <programmierstudi at gmx.de> wrote:

>1. lot of additional network traffic because every request to any page
>will
>result in the sp asking the idp if there is a valid shib session

To add context to what Nate/Peter said, you are confused about this. The
SP never "asks" the IdP if there is a valid session, that isn't how it
works. It sends the client to the IdP to get an assertion if there is no
valid session locally. The IdP and SP sessions individually have nothing
do with each other. The wiki includes an overview of the system as a whole
as implemented by this software.

So no, this is a totally unworkable idea. It also does nothing to solve
SLO. SLO implies that nothing the user has accessed remains accessible
after a logout. It is effectively, because of technical and historical
reasons, impossible. The long history of Shibboleth lacking logout means
that nothing will ever achieve true logout in any but isolated/controlled
cases.

-- Scott