What's Shibboleth's view on the Logout functionality?

[Wayne Si]

Hi Scott and the Shibboleth team,

I'm a developer of an application which also acts as a SP of its own. So my code needs to work with the Shibboleth IdP v3.1.1 using the ComponentSpace SAML library. Because we're the SP side and have no control on the IdP's configuration, we hope our code can at least work with the default configuration of the IdP in our dev and testing environment.

We managed to get the login part working properly and get the IdP responding to the LogoutRequest thanks to Scott's help yesterday. However the IdP response on the LogoutRequest always returns An error occurred which is exactly same as David described in his email http://shibboleth.1660669.n2.nabble.com/Logout-SAML-Error-message-v3-td7610948.html. David wanted to get more error details returned in the IdP response as expressed in his issue ticket https://issues.shibboleth.net/jira/browse/IDP-576, however I'm more interested in what exactly causes the error and how to fix it. All I want is that the Shibboleth IdP can destroy the cookie shib_idp_session and shib_idp_session_ss on the client side, or at least invalidate the session id held in the cookie in IdP's memory. Are there any built-in way or some property switches to achieve it? Do we have to customize IdP's workflow or ask the users to close down the browser?

Please advise. Thank you very much in advance.

Kind regards,
Wayne Si
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150730/a8d3047d/attachment.html>