IDP Logout, text asking user whether or not to kill the IDP session

[Steven Carmody]

On 10/15/13 5:31 PM, Jim Fox wrote:
>
> It was always RL Bob's insistence that logging out of an app should not
> necesssarily log one out of SSO.  When someone logs out of an app,
> be it a shib sp or a weblogin sp, the user gets redirected to the weblogin
> service where she is told, "You have logged out of xxxxxx.  You are still
> logged in to weblogin as yyy.  Completely exit your browser to log out
> of weblogin."
>

Jim -- thanks !

And a Shibboleth question for the list -- I believe the Logout endpoint 
in the Shib SP can be passed a url; after killing the local SP session 
it will redirect the browser to that url. Typically, that URL would be 
the Logout endpoint of the IDP that was used ....

If that endpoint wanted to display a page saying something like "You 
have logged out of xxxxxx.  You are still logged in to weblogin as yyy."

would it automatically be receiving anything from the SP to help it fill 
in the XXX's and YYY's in that page ?

I *think* the only way it would be able to obtain the SP's name is 1) 
the SP would have to append a value on the url redirecting back to the 
IDP; that value would identify the SP; and 2) that value would be either 
a human-readable string (which could be displayed) or an entityID (which 
would necessitate a metadata lookup to obtain the SP's display name). Is 
there an easier way for the IDP endpoint to obtain a displayable value ?

The IDP endpoint could only obtain a displayable name for the user by 
looking into information maintained within the IDP session ? Is there an 
"easy" way to do that ?

Thanks !