IDP Logout, text asking user whether or not to kill the IDP session

[Jim Fox]

I forgot to mention something that ought to be obvious but usually isn't.
If you log out of, say, application X, and you get to the "you have logged out of
application X", and you go right back to 'application X, you will be silently logged in again.
It seems counterintuitive, but that is the nature of SSO.

You are not really logged out of anything until you throw your workstation into saltwater.

Jim


On Oct 16, 2013, at 1:58 PM, Steven Carmody wrote:

> On 10/16/13 1:43 PM, Cantor, Scott wrote:
>> On 10/16/13 1:12 PM, "Steven Carmody"<steven_carmody at brown.edu>  wrote:
>>> 
>>> And a Shibboleth question for the list -- I believe the Logout endpoint
>>> in the Shib SP can be passed a url; after killing the local SP session
>>> it will redirect the browser to that url. Typically, that URL would be
>>> the Logout endpoint of the IDP that was used ....
>> 
>> If you do the proprietary thing, yes. The SAML logout case just goes to
>> the endpoint in the metadata.
>> 
> 
> thanks.
> 
> is it possible to redirect to the SP's /Shibboleth.sso/Logout endpoint, 
> and tell it "and redirect to the metadata-based Logout endpoint of 
> whatever IDP was used to create this session?"
> 
> As I understand it, I can pass the Logout endpoint a url to redirect to, 
> but my application would have to identify the IDP that was used, and 
> then "somehow" obtain the url for its Logout endpoint.
> 
> is there a simpler way ?
> 
> thanks!
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net