Reasons to use/not use HTML local storage?

[Cantor, Scott]

On 11/30/15, 4:42 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:



>On 11/30/15, 4:36 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:
>
>>Thanks, Scott. Yes, that does, in fact, appear to be the case. I get an IDP error with this feature enabled when performing an SAML logout from my favorite non-Javascript browser (Lynx).
>
>What's the error? That isn't what I would expect, since it's still obligated to tell the SP something. I thought it would actually just return to the SP.

In a quick test, I'm seeing it issue a LogoutResponse to the SP with an UnknownPrincipal substatus, which was my recollection of how it's currently coded to work. That applies to any case where the LogoutRequest's NameID doesn't match, but specifically this case, with a browser turning off JS so falling back to cookies.

It isn't good form, but it's probably possible to trap the event locally and produce a custom error, it's just that the SP will be left without any answer. Which is fine in Shibboleth mostly, but might not be with other SPs (I don't think it works for ADFS for example).

But if an SP is claiming to support logout and not handling errors back, it doesn't really support logout. An error is a likely outcome for all sorts of reasons.

Note that this is different from the behavior at /idp/profile/Logout. That is not a SAML logout, that's a plain redirect to clear the session on that front-channel. And that will simply do the logout and not know that any other SPs are involved so would have to be the usual message you'd get in older versions.

-- Scott