Verständnisfrage zur Reihenfolge beim Logout

[Peter Schober]

* Martin Lunze <martin.lunze at tu-dresden.de> [2013-07-30 09:02]:
> I have two service providers (SP) working together with one and the same
> identity provider (IdP).

Are those SPs of the same version? Test with `shibd -v`.

> To test at which position the user is redirected to which URL at the SP
> and IdP i have installed firebug for mozilla.
> Since i am no expert in using firebug, i couldn't collect much
> information.

Have a look at the Mozilla Firefox extension "SAML tracer". It will
show you HTTP Request and Response headers, and will also decode
front-channel SAML protocol messages for you. HTTP Requests containing
SAML messages will show an orange "SAML" image and by clicking on one
of those lines a "SAML" tab appears in the split window. There you
will see the fully decoded logout request.
I'm guessing that the SP staying on the IdP is sending the async
extension, and the one returning to the SP is not.

> I also want to know how you are using logout.

Not.

You did read the SLOIssues topic in the wiki?

(My) Short version: If you control all the SPs your IdP will ever
federate with (and have an IdP that supports SLO) you can very likely
make SLO work reliably. Then you add another SP management cars about
(which of course does not support SLO) and your "single" logout breaks
down.

Many have cooked up various ways to log out the subject from select
few local ("important") systems, potentially leaving any other SPs
(the institution cares less about) stranded with sessions. In addition
they may or may not tell the subject to close the browser, fingers
crossed that this will do something useful.

> If i am right, the user is only logged out at IdP side and at the
> side of the SP, which has initiated the logout and NOT logged out
> from all SP he logged in.

When using the 2.4 IdP and enabling an SLO binding in metadata, yes.

> Thats why i would prefer that the logout-site of the IdP is the last
> site the user gets shown, in every case!
> So he can see where he is/was logged in and has the opportunity to log
> out from the other SP.

Just out of curiosity: How exactly would you expect an average
computer user to do that, log out from those other SPs? Based on the
entityIds of those SPs (or display names, if you changed logout.jsp
sufficiently)?
-peter