Single Logout Channel="back"

[Cantor, Scott]

On 12/3/14, 9:51 AM, "Tomaz Majerhold" <tomaz.majerhold at arnes.si> wrote:

>I think that Single Logout is very important, because of data privacy.

Saying "it's important" doesn't make logout magically work though.

If you want to see it not work, turn off third party cookies and then try 
any implementation you can find.

I'm sorry that people are frustrated by that, but we didn't create the 
situation.

SSO and shared machines are not compatible concepts.

>II) So this SLO concept that SP notify application is ok, but it is not 
>well defined. SOAP was NEVER defined by Request/Response message but 
>with WSDL.

No, SOAP does not require WSDL, certainly nothing this trivial. It is 
entirely defined by a message contract, and for a trivial message format, 
WSDL is overkill, but if you want WSDL, nobody's stopping you. But I don't 
know WSDL.

>So what is missing, WSDL!

Have at it, but you don't need WSDL to handle a trivial SOAP message.

>III) So I create my example of WSDL:

Ok. You're welcome to put it in the wiki.

>IV) SP should be able to configure to send notification to all 
>LocationMatch  in Apache HTTP configuration, by Notify tag

The SP doesn't have any way to enumerate those rules, those are in Apache. 
It already supports multiple Notify elements.

-- Scott