How to configure single logout service

Peter Schober peter.schober at univie.ac.at
Fri Nov 15 07:02:49 EST 2013


* Priyanka W Dhoble <Priyanka.Dhoble at bitwiseglobal.com> [2013-11-15 07:46]:
> Usually we have SLO feature. Let's take an example of Google, if I
> logout from any of its site, it logs me out of all of its
> application. So what if I want to implement the same using
> Shibboleth? Is there any way I can implement this. I have to do this
> as client wants this feature.

Did you or did you not read this?
https://wiki.shibboleth.net/confluence/display/SHIB2/SLOIssues
I'm just gonna quote the first sentence from that page (you have to
read the rest for yourself):

"The Shibboleth 2 IdP does not support single logout in any meaningful sense."

> And if it's not possible then what is the way by which I can
> implement logout on particular site.

It's not about a "particular site", it's about any and all sessions on
any and all SPs your IdP federates with.

/If/ you control all the SPs your IdP will ever federate with (that
rules out GAFYD and many other commercial SPs) and all the HTTP User
Agents (e.g. to weaken everyone's privacy by enabling third-party
cookies) users are able to use, you could look at
http://simplesamlphp.org/ as SAML IdP, which supports front channel
SLO out of the box.
If not, you'll have to give up on SLO, like everyone else, basically.
-peter


More information about the users mailing list