AW: LogoutResponse

[Cantor, Scott]

On 8/12/16 11:36 AM, Roehrl Patrick wrote:
> We removed the velocity templates because we're using JSPs, with that the
> logout process was broken...wasn't clear to me that the velocity templates
> contain such a logic, should have taken more eyes on the templates...

It's much more than that, all of the scripts and propagation are in
there, so you really can't do that, you would be better off totally
implementing your own logout flow at that point. It would never stay
functional across releases.

That is all undocumented, so this isn't anything you should have known.
Many of the views outside of login or error handing are pretty much tied
to Velocity in spirit.

> So there are no bugs.

Trust me, our logout code has bugs. Had, has, will have.

> Yeah our SP (it's no Shibboleth) destroys the application session when
> sending the LogoutRequest, but it uses the LogoutResponse to log the
successful
> logout  in our database.

That makes sense, but you should be aware that the IdP always sends a
Success in the response if it manages to get through the basic sequence
at the IdP end. It won't send Partial even if all the propagation fails
because it doesn't know that it did, that's all happening in parallel
with the response.

All logout is partial anyway, save for a tiny set of pathological cases
in which you control all the SPs.

-- Scott