Is Single Logout implemented in Idp v3.1.2 ?

[Cantor, Scott]

On 9/11/15, 11:16 AM, "users on behalf of Павел Шашко" <users-bounces at shibboleth.net on behalf of pavel.shashko at gmail.com> wrote:



>How can I do logout on the Idp side?

If you want SAML logout to work even minimally, you have to switch to using a server-side storage mechanism for the sessions, and changing various options related to logout support (the trackSPSessions and secondaryIndex properties in idp.properties). Until then the logout requests will simply fail.

>Now I am trying to do so:
>When I start logout process from SP, I see request to.../idp/profile/SAML2/POST/SLO and redirect to logout.vm page, but when I try to open my application again - idp's login page does not appear. It seems like sp goes to idp and idp answers that all is ok - user is authenticated.

Because the logout request failed.

>I don't see any erros in idp log. Seems logout process ends successful.

I very much doubt that, but I also know there are some logging issues causing problems when people attempt to use SAML logout without configuring the features required for that, it's a bug being worked on.

-- Scott