AW: LogoutResponse

[Roehrl Patrick]

Thanks the fact that the logout.vm generates the LogoutResponse via an iframe solved my problem!
We removed the velocity templates because we're using JSPs, with that the logout process was broken...wasn't clear to me that the velocity templates contain such a logic, should have taken more eyes on the templates...

So there are no bugs.

Yeah our SP (it's no Shibboleth) destroys the application session when sending the LogoutRequest, but it uses the LogoutResponse to log the successful logout  in our database.

So great now I think I'm finished with the upgrade, Thanks all for your help!

-----Ursprüngliche Nachricht-----
Von: users [mailto:users-bounces at shibboleth.net] Im Auftrag von Cantor, Scott
Gesendet: Freitag, 12. August 2016 15:40
An: users at shibboleth.net
Betreff: Re: LogoutResponse

On 8/12/16 5:21 AM, Roehrl Patrick wrote:
> 
> The IdP2 answered to an LogoutRequest with a LogoutResponse on 
> successful logout.

For a SAML logout, yes.

> In my tests with IdP3, the IdP destroyed the session at the IdP and 
> showed me a successful logout page but didn't sent a LogoutResponse.

The SAML logout endpoint view has a hidden iframe that generates the LogoutResponse back. It's also possible you just hit bugs that were already patched, some of them involved how the flows completed.

> Here (http://shibboleth.net/pipermail/users/2016-April/028726.html ) I 
> found that the logout outs ends always at the IdP, so perhaps the 
> behavior to LogoutRequests has changed?

No, but in point of fact, if the UI ends at the IdP (which it does) then there are very few situations in which the SP getting a response back should matter. If it does matter, the SP/application is either using the response to tear down state (possible, though Shibboleth does not) or it has a bug. Logout from the application must be done by the time the SP issues its LogoutRequest or you have a broken system.

-- Scott
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net