v3 IdP SAML2 logout and external authentication with controlling session

[Scott Koranda]

Hello,

Since I have recently copied the v3 saml2-slo-flow into a user flow in
order to customize it, I am considering as a next step further
customizing the flow to include a front-channel "trip" through the
authentication service (external CAS service in this case integrated
via the Unicon shib-cas-authn3 connector) to remove the session with
it.

My high level view is that after I write some simple code to actually
effect the trip I should be able to inject it into the flow in a
relatively straightforward way and SWF will "do the right thing".

Ignoring the more global issues, is there any reason from the IdP
technical viewpoint that this approach would be a "bad thing" and I
should not explore it?

Thanks,

Scott K

P.S. It may be switching to using the v3 IdP for CAS in addition to
SAML2 is a better solution and I will explore that too. I am assuming
that a v3 response to a SAML2 logout request terminates *the* user
session in that scenario and there is no separate "CAS session" to
manage. That is, if the user's session with the IdP is terminated then
any further new requests from either SAML2 SPs or CAS clients results
in the user having to authenticate again (assuming vanilla
username/password auth) at the IdP.