SLO observations

[Peter MOLNAR]

Dear All!

I managed to configure SLO with Shibboleth 3.2.0, and I would like to share
two observations:
1. In case of SP-Initiated logout, the IdP view does not tell anything
about the SP where the logout was initiated.
2. Even if the user answers 'No' for the 'Would you like to attempt to log
out of all services ....?' question, IdP session will be terminated, and no
more logout can be initiated from other SPs.

-----------------------------------------------

A bit more verbose description:

ad 1. Let's say that the user is logged in on SP1, SP2 and SP3. Once the
user clicks on logout on SP1, an SP-Initiated SLO takes place and the user
will be redirected to an IdP view.
On this view, the 'Would you like to attempt to log out of all
services ....?' question appears. Under the question SP2 and SP3 are
listed.
My problem is that this IdP view does not tell anything about what happened
with SP1. This can be confusing for the user.

In comparison, this part is implemented on a slightly different way in
SimpleSAMLphp IdP.
Namely, after an SP-Initiated SLO, the IdP view shows a prominent 'You have
logged out from SP1' message and under the message it shows the question
with the list of SPs.

In my opinion, it would be useful if Shibboleth could render a 'You have
logged out from SP1' kind of message above the 'Would you like to attempt
to log out of all services ....?' question.

-----------------------------------------------

ad 2. Let's say that the user is logged in on SP1, SP2 and SP3. User logs
out from SP1 and arrives to the 'Would you like to attempt to log out of
all services ....?' question.
What if the user answers 'No' for the question because she needs to finish
some work on SP2? In one hour, the user finishes work on SP2 and clicks
logout.
IdP will not render any view because it will detect that
      Profile Action ProcessLogoutRequest: No active session(s) found
matching LogoutRequest

and it will send back a logout response:
<saml2p:Status>
    <saml2p:StatusCode
Value="urn:oasis:names:tc:SAML:2.0:status:Requester">
        <saml2p:StatusCode
Value="urn:oasis:names:tc:SAML:2.0:status:UnknownPrincipal"/>
    </saml2p:StatusCode>
    <saml2p:StatusMessage>An error occurred.</saml2p:StatusMessage>
</saml2p:Status>

By visiting the http://localhost/idp/profile/Logout, IdP renders a view
with 'The logout operation is complete, and no other services appear to
have been accessed during this session.'
But in reality, SP3 is still logged in!

In comparison, SimpleSAMLphp IdP behaves differently. Namely, after SP
initiated logout from SP1, IdP renders a view with the question. If the
user answers 'No', IdP does not terminate the IdP session.
So, if the user initiates a logout from SP2, the IdP renders a view telling
that 'You logged out from SP2', and raises the question again if you want
to logout from the rest of the services, and lists the remaining SP3.

By checking the log, it looks to me that Shibboleth SLO flow destroys the
IdP session before the user clicks Yes/No. Is this on purpose?
[net.shibboleth.idp.saml.saml2.profile.impl.ProcessLogoutRequest:274] -
Profile Action ProcessLogoutRequest: LogoutRequest matches IdP session
63aa80be80171333ae3111f81d6225212b005f830bcbf43ae48057e8b0988fec
[org.opensaml.storage.AbstractMapBackedStorageService:208] - Deleted
context '63aa80be80171333ae3111f81d6225212b005f830bcbf43ae48057e8b0988fec'
[net.shibboleth.idp.session.impl.StorageBackedSessionManager:552] -
Destroyed session
63aa80be80171333ae3111f81d6225212b005f830bcbf43ae48057e8b0988fec

>From my point of view, it would be better to terminate the IdP session
depending on the user's Yes/No answer. The current implementation might be
confusing from a user point of view, and also for SP operators.

Let me know if you need more details!

Any feedback is warmly welcome!

Thank you!
Peter
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160224/c0efd319/attachment.html>