Single Logout

[Ted Fisher]

I'd like to spawn another thread from this SLO discussion based on a comment that Prog made:
If you want to implement global logout (logout user from all active sessions (IdP, SP, applications he authenticated to) things will grow more complicated rapidly or even impossible, depending strongly on your level of control over all the servers involved.



So, I'd like to ask what others are doing in the situation where you want to attempt global logout but you do not have control over all of the applications.   We have a long established practice of attempting to logout all sessions - IDP, SP, and applications on logout in order to avoid any possibility of a hijacked sessions exposing sensitive data.

But, we have an increasing number of outsourced applications over which we have no control and often having an application session that persists when the SP session has been ended.  This is making our global logout attempt to fall more and more into the "even impossible" category.



How are others handling this kind of scenario?

Is the notion of SLO - particularly in a multi-vendor hodge-podge non-homogenous mess of applications - truly altogether impossible as the Shibboleth docs repeatedly imply?

If so, what are the ways that institutions (educational particularly, since that is our interest) are using to protect against data exposure by sessions left open?



Input appreciated.



Ted F. Fisher

Bowling Green State University



-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Prog
Sent: Friday, November 28, 2014 12:42 PM


Hi,



...



If you want to implement global logout (logout user from all active sessions (IdP, SP, applications he authenticated to) things will grow more complicated rapidly or even impossible, depending strongly on your level of control over all the servers involved.





Regards,



Michael

--

To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141201/6ad51b52/attachment.html