Single Logout Channel="back"

Wed Dec 3 17:48:12 EST 2014

You might want to have a look at the NIIF SLO implementation (latest 
available is IdP 2.3.8).
https://wiki.aai.niif.hu/index.php/Single_Logout_in_Shibboleth_IdP

Recently this implementation was adapted to an IdP plugin (>=2.4):
https://wiki.shibboleth.net/confluence/display/SHIB2/NIIF+SLO+plugin

This extension circumvents the need for the client presenting the shib 
context at every ServiceProvider (which would very likely require Third 
Party Cookies to be accepted by the client as Scott Cantor just 
mentioned) by having the IdP map all SP's the entity authenticated to to 
the particular IdP session. Once logout is initiated (client 
interaction=includes IdP context) the IdP itself notifies all SP's 
involved and can (and should, probably even must) present Logout Success 
for each SP to the user. If one fails you are of course still in the 
same trouble as with no logout at all (user must close browser, cookies 
must be destroyed on browser shutdown etc.). The user might still be 
smart enough to read a warning you present on fail and closes the 
browser (which might not be possible (easily) on mobile devices).

We discovered that this implementation might result in having more than 
one Shibboleth Session ID being sent to the application as the SP 
identifies the entity to be logged out by NameId. In case a user is 
logged in with different User Agents/clients for example, an application 
gets both ids and one probably has to destroy all app sessions for this 
user consequently. Obviously the SP does not distinguish between 
different IdP sessions (though it has the information to do so) but just 
sends notifications for all sessions it carries for the particular 
NameId. (If i missed any configuration detail here, i would very much 
appreciate comments on that.) Finally the IdP session in the client that 
did NOT call the logout will still remain and authenticate the user to 
the app again without asking for credentials. This might even be 
considered as a feature but should always be kept in mind as a potential 
security issue.

Regards,

Michael

Am 03.12.2014 um 10:51 schrieb Tomaz Majerhold:
> I think that Single Logout is very important, because of data privacy.
>
> I) Scenario: We have AAI enabled applications
> a) Users share computer and they logout from one application but not
> close the browser, so another user can access data of first user.
> b) User have multiple AAI accounts, he logout from one application, but
> he don't wont to close a browser and then he login with second AAI
> account in a second application and he will access a data from previous
> AAI account.
>
>
> II) So this SLO concept that SP notify application is ok, but it is not
> well defined. SOAP was NEVER defined by Request/Response message but
> with WSDL.
>
> WSDL defines:
> Services, Bindings, Port Type, Messages, Types
>
> So what is missing, WSDL!
>
> III) So I create my example of WSDL:
> a) Beacuse SP send user shibboleth session id I rename it to
> UserShibSessionId (String)
> b) Return type is boolean:
>       true := appliacation find session ID and destroy user session
>       false := application not find or destroy user session
>
> c) SOAPFault is thrown if same error happened in application
>
> WSDL:
> <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
> <definitions
>       targetNamespace="urn:mace:shibboleth:2.0:sp:notify"
>       name="LogoutNotificationService"
>       xmlns="http://schemas.xmlsoap.org/wsdl/"
>       xmlns:wsp="http://www.w3.org/ns/ws-policy"
>       xmlns:tns="urn:mace:shibboleth:2.0:sp:notify"
>       xmlns:xsd="http://www.w3.org/2001/XMLSchema"
>       xmlns:wsp1_2="http://schemas.xmlsoap.org/ws/2004/09/policy"
>       xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"
>       xmlns:wsam="http://www.w3.org/2007/05/addressing/metadata"
> xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
>
>     <types>
>       <xs:schema version="1.0" xmlns:xs="http://www.w3.org/2001/XMLSchema">
>           <xs:element name="Logout" type="xs:boolean"/>
>           <xs:element name="UserShibSessionId" nillable="false"
> type="xs:string"/>
>       </xs:schema>
>     </types>
>
>     <message name="LogoutNotification">
>       <part name="UserShibSessionId" type="xsd:string"/>
>     </message>
>     <message name="LogoutNotificationResponse">
>       <part name="Logout" type="xsd:boolean"/>
>     </message>
>
>     <portType name="LogoutNotificationService">
>       <operation name="LogoutNotification">
>         <input
> wsam:Action="urn:mace:shibboleth:2.0:sp:notify:LogoutNotificationService:LogoutNotificationRequest"
> message="tns:LogoutNotification"/>
>         <output
> wsam:Action="urn:mace:shibboleth:2.0:sp:notify:LogoutNotificationService:LogoutNotificationResponse"
> message="tns:LogoutNotificationResponse"/>
>       </operation>
>     </portType>
>
>     <binding name="LogoutNotificationServicePortBinding"
> type="tns:LogoutNotificationService">
>       <soap:binding transport="http://schemas.xmlsoap.org/soap/http"
> style="rpc"/>
>       <operation name="LogoutNotification">
>         <soap:operation
> soapAction="http://localhost:8080/appl/LogoutNotificationServiceService/LogoutNotificationService/LogoutNotification"/>
>         <input>
>           <soap:body use="literal"
> namespace="urn:mace:shibboleth:2.0:sp:notify"/>
>         </input>
>         <output>
>           <soap:body use="literal"
> namespace="urn:mace:shibboleth:2.0:sp:notify"/>
>         </output>
>       </operation>
>     </binding>
>
>     <service name="LogoutNotificationService">
>       <port name="LogoutNotificationServicePort"
> binding="tns:LogoutNotificationServicePortBinding">
>         <soap:address
> location="http://localhost:8080/appl/LogoutNotificationServiceService/LogoutNotificationService"/>
>       </port>
>     </service>
> </definitions>
>
>
> SOAP Request:
> <?xml version="1.0" encoding="UTF-8"?><S:Envelope
> xmlns:S="http://schemas.xmlsoap.org/soap/envelope/"
> xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
>       <SOAP-ENV:Header/>
>       <S:Body>
>           <ns2:LogoutNotification
> xmlns:ns2="urn:mace:shibboleth:2.0:sp:notify">
> <UserShibSessionId>_d5628602323819f716fcee04103ad5ef</UserShibSessionId>
>           </ns2:LogoutNotification>
>       </S:Body>
> </S:Envelope>
>
> SOAP Response:
> <?xml version="1.0" encoding="UTF-8"?><S:Envelope
> xmlns:S="http://schemas.xmlsoap.org/soap/envelope/"
> xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
>       <SOAP-ENV:Header/>
>       <S:Body>
>           <ns2:LogoutNotificationResponse
> xmlns:ns2="urn:mace:shibboleth:2.0:sp:notify">
>               <Logout>true</Logout>
>           </ns2:LogoutNotificationResponse>
>       </S:Body>
> </S:Envelope>
>
> IV) SP should be able to configure to send notification to all
> LocationMatch  in Apache HTTP configuration, by Notify tag
>
>
> Regards, Tomaz
>
>
>
>