SLO in shiboleth

[Peter Schober]

* Stefan Rasmusson <rasmusson.stefan at gmail.com> [2014-01-20 13:27]:
> I'm reading up on the SLO capabillitites of Shiboleth. On
> https://wiki.shibboleth.net/confluence/display/SHIB2/SLOIssues it says
> "The easiest is to remove all application level session management and rely
> solely on the Shibboleth SP's session management"
> 
> Is it correct to assume that this sessionmanagement only refers to
> authenticated session managament. The application should not use the
> appliation session to validate that a user is authenticated.

That's the idea, yes, to get rid of further sessions that would still
allow access to the resource. You could also take care of them using
the "notify" support:
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPNotify

> But its ok to store other information on the application session, right?

That's basically unavoidable since you can't use the SP's session for
that.

> If we do this and use backchannel SLO, would it be correct to assume
> that the SLO will work good?

Well, as far as your SP is concerned, yes. Which only leaves all the
other SPs and applications (still using their own sessions) in the
world your users might have established a session with.
-peter