invalidating a session for a disabled user (Shibboleth SP)

[Cantor, Scott]

On 3/17/14, 11:14 AM, "Flannery, Sean" <sean.flannery at jwt.com> wrote:

>Is there a best standard for invalidating a user's session manually?  I'm
>wondering how easy it is to support a situation where a user has been
>disabled, i.e. removed from LDAP, and has an active SP session that
>we want to immediately invalidate?

Virtually impossible because application sessions would normally be
unknown to the SP anyway, but that varies by deployment. There is no
single answer to any question pertaining to sessions.

>Most the documentation I'm finding seems to do with user-initiated logout
>rather system-managed.  My thought was, since the application that cares
>about this level of access can query LDAP, that it (the downstream app)
>just verify the user is still there, but there has been a request to
>see if we can manage this above that app and force the user to lose his
>SP session.

An application that could query LDAP is not a normal case for a
SAML-enabled application, so the answer is not really to query LDAP but
that the use case is effectively impractical.

>From the SP side of things, if you can send it a SOAP logout request with
the appropriate SAML information corresponding to the session, then the SP
will remove it.

The IdP does not support administratively triggered logout (or in general
SAML logout at all per the wiki).

The SP also supports the SAML NameID management profile, which includes
the ability to terminate state related to a subject, but only by relaying
the notification to something else. And the IdP doesn't support that
profile either.

-- Scott