IDP logout in V3

[Cantor, Scott]

On 6/29/15, 5:19 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

>Following up to my own note, it appears I might be missing something.
>
>After trying a logout request with client side storage enabled per IDP V3 defaults, I get an IDP error. This error was described by DaveL back in January on the list and was logged in Gira under IDP-576.
>
>The discussion and ticket that followed seemed to indicate that IDP logout won't work when using client-side storage.
>
>Has something changed since January that I'm not finding? Or is that still the case?

No, I probably wasn't really thinking through what you were asking, or I was thinking ahead to once we get local storage working.

The only kind of logout that works with a cookie alone is the front-channel non-SAML thing at /idp/profile/Logout.

A SAML logout will always fail, there's no store to lookup the NameID against.

-- Scott