SLO

[Cantor, Scott]

> I believe an option for achieving this is:
> 
> 1)	On logout having the user access the
> https://aaa.bbb.com/Shibboleth.sso/Logout to terminate the users session
> on the SP
> 2)	Modifying localLogout.html on the SP to redirect the user to the
> localLogout on the IdP

You could, but it would probably be "better" in general to use the SAML protocol for that, if for no other reason than if it doesn't work for this constrained a case, it's not even worth continuing to talk about it.

The local hook is not meant for use by systems that are not tightly coupled, though it sounds like that might be true in this case. To be more explicit, if you don't have direct control over or at least a tight relationship with the systems generating links to the proprietary hook, you're asking for trouble using it, just like any non-standard mechanism.

-- Scott