Single Logout Channel="back"

[Cantor, Scott]

On 12/3/14, 10:48 PM, "Prog" <programmierstudi at gmx.de> wrote:
>
>This extension circumvents the need for the client presenting the shib 
>context at every ServiceProvider (which would very likely require Third 
>Party Cookies to be accepted by the client as Scott Cantor just 
>mentioned) by having the IdP map all SP's the entity authenticated to to 
>the particular IdP session.

That only works if every application is using the SP session, which is 
almost never the case. Otherwise you're back to needing a cookie to get 
the application handled most of the time.

>Obviously the SP does not distinguish between
>different IdP sessions (though it has the information to do so) but just 
>sends notifications for all sessions it carries for the particular 
>NameId. (If i missed any configuration detail here, i would very much 
>appreciate comments on that.)

If you're talking about SessionIndex, the SP should only be looking at 
sessions that have the matching SessionIndex. If it's not present, then it 
will be looking at all of them. I don't recall if the SP includes the 
SessionIndex when it requests a logout, but I thought it did.

>Finally the IdP session in the client that 
>did NOT call the logout will still remain and authenticate the user to 
>the app again without asking for credentials. This might even be 
>considered as a feature but should always be kept in mind as a potential 
>security issue.

That shouldn't happen unless the IdP end is broken (but since the V2 
design precludes all this from really working, I can't imagine that you 
haven't run into something along that line).

-- Scott