Configuring return URL on Logout

[Peter Schober]

* Peter Gillard-Moss <pgillard at thoughtworks.com> [2014-06-18 10:56]:
> We need to provide local logout and we are using the URL /Logout
> successfully.  However we wish to redirect to the IdP which displays a
> status page of your SSO status and the status of applications logged into.
>  It also gives a clear logout button.

"Need" local logout is weird in itself, but combining that requirement
(local logout == don't tell the IDP about it) with a page at the IDP
that claims to be able to track SSO status and logged out applications
is "interesting".

> >From the documentation we can't decipher how to configure shibboleth to
> redirect to our URL.  The only thing we've found is to put the URL as a
> value to the return query string parameter.  We would far prefer to
> configure this within Shibboleth thus allowing applications to be
> completely ignorant (and avoid people getting it wrong, allowing it to
> change etc.).

"People" meaning SP administrators, right? Because end users will
always be able to do whatever they want with URLs you present them.

I don't think there's a way to do that. Either way it would be
something the SP or websever admin would have to configure herself
anyway. And a simple Redirect directive in httdp would achieve that,
no? Are you asking this specifically because you intend to generate
shibboleth2.xml files for SPs of yours? That's the only use-case I
can imagine where having something inside shibboleth2.xml could save
the admin this one step.
-peter