LogoutResponse

[Cantor, Scott]

On 8/12/16 5:21 AM, Roehrl Patrick wrote:
> 
> The IdP2 answered to an LogoutRequest with a LogoutResponse on
> successful logout.

For a SAML logout, yes.

> In my tests with IdP3, the IdP destroyed the session at the IdP and
> showed me a successful logout page but didn’t sent a LogoutResponse.

The SAML logout endpoint view has a hidden iframe that generates the
LogoutResponse back. It's also possible you just hit bugs that were
already patched, some of them involved how the flows completed.

> Here (http://shibboleth.net/pipermail/users/2016-April/028726.html ) I
> found that the logout outs ends always at the IdP, so perhaps the
> behavior to LogoutRequests has changed?

No, but in point of fact, if the UI ends at the IdP (which it does) then
there are very few situations in which the SP getting a response back
should matter. If it does matter, the SP/application is either using the
response to tear down state (possible, though Shibboleth does not) or it
has a bug. Logout from the application must be done by the time the SP
issues its LogoutRequest or you have a broken system.

-- Scott