Logout SAML Error message v3

[Cantor, Scott]

> Ok, so the v3 IdP, by default, is set to use client-side sessions, the auto-
> generated metadata has the logout endpoints advertised, and the docs
> currently written seem to encourage the deployer to stick with client-side
> sessions.

Defaults are just defaults. People need to use what they think they need to use. There's no discussion on logout yet because it's not really implemented more than before, so the impact on settings isn't really documented to this point.

>  I would very much appreciate it if the IdP would do something
> more in this case than sending the SP the generic message of "An error has
> occurred."  Ideally, the IdP would either kill the session cookies in the
> browser and display some kind of "you only think you've SLO'd" message or
> something a little more detailed would show up in the process log / be sent
> to the SP describing "client-side sessions are not compatible with logout".

That will be a fair bit of work, so you'd best file a bug to track it.

> I am interested though in the specific event to trap in the meantime.

Once I have time to research what actually gets triggered, I can put that into the issue filed.

-- Scott