Single Logout Channel="back"

[Tomaz Majerhold]

I think that Single Logout is very important, because of data privacy.

I) Scenario: We have AAI enabled applications
a) Users share computer and they logout from one application but not 
close the browser, so another user can access data of first user.
b) User have multiple AAI accounts, he logout from one application, but 
he don't wont to close a browser and then he login with second AAI 
account in a second application and he will access a data from previous 
AAI account.


II) So this SLO concept that SP notify application is ok, but it is not 
well defined. SOAP was NEVER defined by Request/Response message but 
with WSDL.

WSDL defines:
Services, Bindings, Port Type, Messages, Types

So what is missing, WSDL!

III) So I create my example of WSDL:
a) Beacuse SP send user shibboleth session id I rename it to 
UserShibSessionId (String)
b) Return type is boolean:
     true := appliacation find session ID and destroy user session
     false := application not find or destroy user session

c) SOAPFault is thrown if same error happened in application

WSDL:
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<definitions
     targetNamespace="urn:mace:shibboleth:2.0:sp:notify"
     name="LogoutNotificationService"
     xmlns="http://schemas.xmlsoap.org/wsdl/"
     xmlns:wsp="http://www.w3.org/ns/ws-policy"
     xmlns:tns="urn:mace:shibboleth:2.0:sp:notify"
     xmlns:xsd="http://www.w3.org/2001/XMLSchema"
     xmlns:wsp1_2="http://schemas.xmlsoap.org/ws/2004/09/policy"
     xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"
     xmlns:wsam="http://www.w3.org/2007/05/addressing/metadata"
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">

   <types>
     <xs:schema version="1.0" xmlns:xs="http://www.w3.org/2001/XMLSchema">
         <xs:element name="Logout" type="xs:boolean"/>
         <xs:element name="UserShibSessionId" nillable="false" 
type="xs:string"/>
     </xs:schema>
   </types>

   <message name="LogoutNotification">
     <part name="UserShibSessionId" type="xsd:string"/>
   </message>
   <message name="LogoutNotificationResponse">
     <part name="Logout" type="xsd:boolean"/>
   </message>

   <portType name="LogoutNotificationService">
     <operation name="LogoutNotification">
       <input 
wsam:Action="urn:mace:shibboleth:2.0:sp:notify:LogoutNotificationService:LogoutNotificationRequest" 
message="tns:LogoutNotification"/>
       <output 
wsam:Action="urn:mace:shibboleth:2.0:sp:notify:LogoutNotificationService:LogoutNotificationResponse" 
message="tns:LogoutNotificationResponse"/>
     </operation>
   </portType>

   <binding name="LogoutNotificationServicePortBinding" 
type="tns:LogoutNotificationService">
     <soap:binding transport="http://schemas.xmlsoap.org/soap/http" 
style="rpc"/>
     <operation name="LogoutNotification">
       <soap:operation 
soapAction="http://localhost:8080/appl/LogoutNotificationServiceService/LogoutNotificationService/LogoutNotification"/>
       <input>
         <soap:body use="literal" 
namespace="urn:mace:shibboleth:2.0:sp:notify"/>
       </input>
       <output>
         <soap:body use="literal" 
namespace="urn:mace:shibboleth:2.0:sp:notify"/>
       </output>
     </operation>
   </binding>

   <service name="LogoutNotificationService">
     <port name="LogoutNotificationServicePort" 
binding="tns:LogoutNotificationServicePortBinding">
       <soap:address 
location="http://localhost:8080/appl/LogoutNotificationServiceService/LogoutNotificationService"/>
     </port>
   </service>
</definitions>


SOAP Request:
<?xml version="1.0" encoding="UTF-8"?><S:Envelope 
xmlns:S="http://schemas.xmlsoap.org/soap/envelope/" 
xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
     <SOAP-ENV:Header/>
     <S:Body>
         <ns2:LogoutNotification 
xmlns:ns2="urn:mace:shibboleth:2.0:sp:notify">
<UserShibSessionId>_d5628602323819f716fcee04103ad5ef</UserShibSessionId>
         </ns2:LogoutNotification>
     </S:Body>
</S:Envelope>

SOAP Response:
<?xml version="1.0" encoding="UTF-8"?><S:Envelope 
xmlns:S="http://schemas.xmlsoap.org/soap/envelope/" 
xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
     <SOAP-ENV:Header/>
     <S:Body>
         <ns2:LogoutNotificationResponse 
xmlns:ns2="urn:mace:shibboleth:2.0:sp:notify">
             <Logout>true</Logout>
         </ns2:LogoutNotificationResponse>
     </S:Body>
</S:Envelope>

IV) SP should be able to configure to send notification to all 
LocationMatch  in Apache HTTP configuration, by Notify tag


Regards, Tomaz