SP Logout, redirecting to the IDP

[Cantor, Scott]

> Is there an *easy* way to tell the local Logout endpoint to then
> redirect to the Logout endpoint at the IDP associated with this session
> (if such an endpoint exists) ?

Well, there's SAML and there's "not SAML". Hitting that endpoint already issues a SAML logout request by default if a SAML endpoint exists at the IdP. If not, and you want to do something proprietary, you'd use a return parameter and set that to go to the IdP (and then possibly somewhere else by embedding a nested return parameter and doing something with it on the IdP end).

> I know the app can append a return attribute on the url that is
> redirecting to Shibboleth.sso/Logout ... but then the app has to figure
> out the url for the IDP's Logout endpoint ... not necessarily an easy
> task for an app.  ;-)

There is no other way. If you don't want to do something out of band, then you use SAML.

-- Scott