How to configure single logout service

[Brian Reindel]

Priyanka, we did a lot of research for this as well when we wanted
full SLO (as most developers would understand it), and it simply isn't
possible with Shibboleth across a federation. If all your SPs are on
the same domain then you may be able to do it with a custom logout
(which is what we did), but otherwise it isn't possible. My exact
question was how do I get logged out across all SPs when clicking a
logout link from any one SP in the federation, and the answer back was
that you can't.

This has nothing to do with the underlying sessions for the
applications or containers sitting behind Shibboleth. That is a
different discussion altogether, and one in which even if Shibboleth
did support full SLO you would have to deal with.


On Wed, Nov 13, 2013 at 5:02 AM, Peter Schober
<peter.schober at univie.ac.at> wrote:
> * Priyanka W Dhoble <Priyanka.Dhoble at bitwiseglobal.com> [2013-11-13 10:38]:
>> Can you please tell me if Shibboleth does not support SLO then what the below documentation explains?
>> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPSAML2LogoutRequestProfileConfig
>
> That page begings with:
>
> "This profile configuration enables and configures the IdP's limited
> support for the SAML 2 Single Logout (SLO) profile. This feature is
> available in V2.4.0 and later.
>
> This is part of, but not the entire, configuration needed with logout
> support. For a more general overview/example, see the IdPEnableSLO
> topic."
>
> The key word being "limited" here, and the link to the IdPEnableSLO
> page (see below, where I quote the web page for you).
>
>
>> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSingleLogoutService
>
> You wrote:
>
> * Priyanka W Dhoble <Priyanka.Dhoble at bitwiseglobal.com> [2013-11-13 10:23]:
>> I need to configure single logout service using Shibboleth idp.
>
> So the documentation about the Shibboleth SP (which does support SLO)
> is completely unrelated. In the future the IdP and the SP will have
> seperate "spaces" in the documentation, which may or may not make it
> more clear that they are two different products.
>
>> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPEnableSLO
>
> That page begings with:
>
> "Shibboleth has a long and tortured history with logout as a concept,
> and nothing's really changed in that regard, but after many
> conversations, we have provided a very limited form of logout as part
> of V2.4.0 that supports the basic use case of terminating a client
> session with the IdP. This is a very difficult feature to explain to a
> user, and should only be deployed after careful consideration.
>
> Use of this feature in its current form will not result in a user's
> sessions with most applications being removed"
>
>
> Granted the IdPSAML2LogoutRequestProfileConfig page itself is not
> as clear as it possibly could be when you do only cursory reading. Not
> that I would expect people to start reading up on Shibboleth by
> reading that (Myself I've never looked at that page, but then I only
> use Shibboleth since 2007).
> -peter
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net