Configuring return URL on Logout

[Peter Schober]

* Peter Gillard-Moss <pgillard at thoughtworks.com> [2014-06-18 13:01]:
> In terms of logout we wish the user to be able to initiate a logout
> sequence from the app.  The first step (when the user clicks 'Log out') is
> to instruct Shibboleth to logout of the app locally.  We do this with a
> hyperlink to /sso/Logout (which goes to mod_shib).  We are trusting that
> Shibboleth 'does the right thing' here and expires the session.

If you are creating a link in the application pointing to
/sso/Logout (assuming that means you have remapped the SP's handlerURL
from /Shibboleth.sso to /sso) you could just as well create a link to
that with the return parameter added, IMHO.
Or abstract the redirect out to a Redirect directive in httpd, as
previously said.

Insteaf of combining "local" logout with sending the subject to the
SAML IDP you could just use SAML2 SLO (assuming the IDP has an SLO
endpoint) and let the SP take care of selecting the URL for the IDP.
Then you wouldn't have to add a URL in a request parameter at all.

> To continue the logout sequence we then wish to redirect to the IdP.  The
> IdP can then display its status with a clear message that you are still
> logged in at a global level and give a clear option to logout globally.
>  Now, we understand the caveats of the fact that other individual apps may
> or still have session active etc. but that is an entirely different avenue
> from my OP.

Not sure what "OP" means here but only looking out for yourself only
"works" if you are the SP initiating the logout sequence. What if it's
at another SP? Then selfish-logout (or selfish-noop, see below)
doesn't work at all (for your resource). And then your own SP also
still "suffers" from SSO at the IDP, so local logout even stared from
your SP is mostly a noop. If any text at the SP or IDP suggests to
subjects it's safe to leave the browser after local logout that's
negligent, IMHO.

But then I think there is no generel Logout Problem, unless you
specifically need to cater to kiosks (where you tightly control the
environment and broswser and desktop anyway) or need to share
authenticated devices, between users, at the same time, which don't
have a private browsing mode.
Personally I never need to logout, ever, anywhere. When doing an demo
of some kind that requires authentication on a notebook from someone
else hooked up to a beamer I start private browsing mode before doing
anything (and would still be vulnerable to keyloggers, so just any
notebook won't do it), then I close the browser at the end and am done.

> Another reason for local logout is so, if the IdP has been logged out, but
> the Shibboleth session is still active, the user can still initiate logout
> from our app.

Sorry, I don't understand that. And you can always access the Logout
initiator at the SP, with or without a session (and with SLO or Local
logout).

> So at the moment we are achieving this with a link to /sso/Logout?return=
> http://IdP/status.  For a number of sound reasons we *don't* want the
> application to be in control of the return URL (we don't want them to even
> know of its existence).

But you do need to make the application aware of /a/ URL to point to
to initiate logout.

> We want this to be configured in Shibboleth once and the exact same
> configuration passed to all apps.

As I said, the docs don't mention that this is possible
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPLogoutInitiator 
So unless the code (or Scott) says differently, it is what it is.
-peter