Synchronous SAML SLO

[Cantor, Scott]

> this is a single IdP3.2.1, single SP 2.6. I set the LogoutInitiator for
> the SP to asynchronous="false".

One reason not to do that is that there really is no purpose to it anymore. That was why we defaulted to what we did. It was why we created the extension in fact.

> Upon access to sp/Shibboleth.sso/Logout?return=XXX, the SP correctly does the SLO
> request, the IdP returns a 200 with the "logout complete" view. Then in
> SAML tracer, I can see a LogoutResponse being sent back to the SP, and a
> GET request to XXX. However, what I *see* in the browser is still the
> "logout complete" view i.e. the whole response logic seems to work
> behind the scenes. How can this be?

Because that is the only viable UI for single logout, the IdP has to maintain control to propagate the messages.

> What I expected was the SP to report
> the logout operation, and/or a return to XXX. I remember this used to
> work with IdP 2.4 those days.

The IdP didn't implement single logout before, now it does (or tries to).

-- Scott