Single Logout Channel="back"

[Cantor, Scott]

On 12/9/14, 9:49 PM, "Prog" <programmierstudi at gmx.de> wrote:



>Thank you Scott for the hints about session indexing. In another older 
>thread you suggested to decrease the lifetime of the NameID to a 
>minimum. I have set the lifetime of the transientId to PT1S. Now we get 
>different transients on every login, even for the same user. I bet, 
>though i did not verify this far, that now we only have one 
>shibsessionId being sent by an SP to the application on Logout 
>consequently.

That's likely true, yes. The transient lifetime thing is just a design 
bug, it should never reuse them.

>By now, i cannot fully estimate the implications by decreasing the 
>lifetime that rigorously. Does it just inhibit attribute queries (we 
>only push)? I found at least that session mapping for SLO purposes seems 
>not to be implied. Furthermore i am going to switch to crypto 
>transients, which you mentioned as being another alternative.

It shouldn't have any impact on the reverse mapping for logout, that's a 
separate mapping table. I don't recall how it impacts queries, that's easy 
enough to test, but I think it does break them. There's nothing else it 
could affect that I can think of.

>Could you by chance point me to other/similar 'surprises' we might run 
>into, which are not mentioned on the wiki?

I can't really know what people don't know, but I have months of work 
ahead of me to document V3, I have no time to even think about V2 anymore.

>By usage of the NIIF extension, customization of the participating 
>services where necessary (get rid of app sessions/logout 
>implementation), adjusting all session lifetimes so that a given IdP 
>session always survives related SP sessions which in turn always survive 
>related app sessions (at least by a remaining reference in the SPs 
>cache), the usage of ultra-short living transients and logout 
>communication via backchannel the IdP-initiated global logout seems to 
>work very well.

I think the moon landings required less coordination than that. All I can 
say is you are one determined person.

-- Scott