IDP Logout, text asking user whether or not to kill the IDP session

[Bryan E. Wooten]

+2

On 10/16/13 9:49 PM, "Jim Fox" <fox at washington.edu> wrote:

>
>I forgot to mention something that ought to be obvious but usually isn't.
>If you log out of, say, application X, and you get to the "you have
>logged out of
>application X", and you go right back to 'application X, you will be
>silently logged in again.
>It seems counterintuitive, but that is the nature of SSO.
>
>You are not really logged out of anything until you throw your
>workstation into saltwater.
>
>Jim
>
>
>On Oct 16, 2013, at 1:58 PM, Steven Carmody wrote:
>
>> On 10/16/13 1:43 PM, Cantor, Scott wrote:
>>> On 10/16/13 1:12 PM, "Steven Carmody"<steven_carmody at brown.edu>  wrote:
>>>> 
>>>> And a Shibboleth question for the list -- I believe the Logout
>>>>endpoint
>>>> in the Shib SP can be passed a url; after killing the local SP session
>>>> it will redirect the browser to that url. Typically, that URL would be
>>>> the Logout endpoint of the IDP that was used ....
>>> 
>>> If you do the proprietary thing, yes. The SAML logout case just goes to
>>> the endpoint in the metadata.
>>> 
>> 
>> thanks.
>> 
>> is it possible to redirect to the SP's /Shibboleth.sso/Logout endpoint,
>> and tell it "and redirect to the metadata-based Logout endpoint of
>> whatever IDP was used to create this session?"
>> 
>> As I understand it, I can pass the Logout endpoint a url to redirect
>>to, 
>> but my application would have to identify the IDP that was used, and
>> then "somehow" obtain the url for its Logout endpoint.
>> 
>> is there a simpler way ?
>> 
>> thanks!
>> --
>> To unsubscribe from this list send an email to
>>users-unsubscribe at shibboleth.net
>
>--
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net