Synchronous SAML SLO

[Cantor, Scott]

> If there was only one SP, couldn't the IdP return control to the
> initiating SP?

That's just inconsistent for users, and it's an edge case anyway, there is almost always more than one.

> Or actually, wouldn't a feature idp.logout.dontpropagate
> make sense? I can imagine many SPs that want to terminate their and the
> IdP's session, but cannot speak for other SPs.

I don't think it's the SP's business what happens to sessions with other SPs, and there is no way to signal that anyway.

There are many things people want the logout feature to do differently and some of them may or may not eventually get done and others are entirely up to the deployer to modify the templates to do, but those are IdP changes.

But an option not to propagate is not up to the SP, it's up to the deployer of the IdP, as is where the user ends up. Not least because there is no way to control any of this in the standard. If there's no propagation, then a full frame response is a possibility and if and when we implement such a thing, I'm sure that could be one of the options. But an SP could never count on it happening because the SP doesn't control the IdP, so it serves no real purpose.

-- Scott