IDP logout in V3

[Wessel, Keith]

Thanks, Scott. No, I think you explained correctly, I just missed the full depth of what you were saying about NameID.

And I suppose it would be a very bad idea to publish /idp/profile/Logout as my SAML2 SLO redirect endpoint in metadata, especially of folks are expecting it to do something SAML-ish such as asynchronous logout?

Only reason I'd do this is so that /Shibboleth.sso/Logout still works properly from the SPs.

Putting a database in place to make things work correctly is major overkill and adds a single point of failure that we aren't prepared to deal with. At least with Paul's db-backed storage service added onto V2, life would go on in an unclustered sense if my database was down. From what I'mr eading here, I can't have both database and in-memory storage, thus cookies are the way to go if I'm willing to hack logout.

Keith


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Monday, June 29, 2015 4:49 PM
To: Shib Users
Subject: Re: IDP logout in V3

On 6/29/15, 5:19 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

>Following up to my own note, it appears I might be missing something.
>
>After trying a logout request with client side storage enabled per IDP V3 defaults, I get an IDP error. This error was described by DaveL back in January on the list and was logged in Gira under IDP-576.
>
>The discussion and ticket that followed seemed to indicate that IDP logout won't work when using client-side storage.
>
>Has something changed since January that I'm not finding? Or is that still the case?

No, I probably wasn't really thinking through what you were asking, or I was thinking ahead to once we get local storage working.

The only kind of logout that works with a cookie alone is the front-channel non-SAML thing at /idp/profile/Logout.

A SAML logout will always fail, there's no store to lookup the NameID against.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net