How to configure single logout service

[Peter Schober]

* Priyanka W Dhoble <Priyanka.Dhoble at bitwiseglobal.com> [2013-11-13 10:38]:
> Can you please tell me if Shibboleth does not support SLO then what the below documentation explains?
> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPSAML2LogoutRequestProfileConfig

That page begings with:

"This profile configuration enables and configures the IdP's limited
support for the SAML 2 Single Logout (SLO) profile. This feature is
available in V2.4.0 and later.

This is part of, but not the entire, configuration needed with logout
support. For a more general overview/example, see the IdPEnableSLO
topic."

The key word being "limited" here, and the link to the IdPEnableSLO
page (see below, where I quote the web page for you).


> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSingleLogoutService

You wrote:

* Priyanka W Dhoble <Priyanka.Dhoble at bitwiseglobal.com> [2013-11-13 10:23]:
> I need to configure single logout service using Shibboleth idp.

So the documentation about the Shibboleth SP (which does support SLO)
is completely unrelated. In the future the IdP and the SP will have
seperate "spaces" in the documentation, which may or may not make it
more clear that they are two different products.

> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPEnableSLO

That page begings with:

"Shibboleth has a long and tortured history with logout as a concept,
and nothing's really changed in that regard, but after many
conversations, we have provided a very limited form of logout as part
of V2.4.0 that supports the basic use case of terminating a client
session with the IdP. This is a very difficult feature to explain to a
user, and should only be deployed after careful consideration.

Use of this feature in its current form will not result in a user's
sessions with most applications being removed"


Granted the IdPSAML2LogoutRequestProfileConfig page itself is not
as clear as it possibly could be when you do only cursory reading. Not
that I would expect people to start reading up on Shibboleth by
reading that (Myself I've never looked at that page, but then I only
use Shibboleth since 2007).
-peter