IdPv3 SLO redirect request failures

[O'Dowd, Josh]

> You underatand that doesn't work either, right? Closing the browser does nothing anymore.

> You would have to tell them to clear their browser history (we really mean cookies, but users see it as all one thing).

It works fine.  The stipulation is that the SP do a 'local' logout prior to redirecting the user to the IdP logout page.  One of the biggie examples we have on campus is box.com cloud storage.  They are part of the group that hasn't figured out how to do a SAML logout request.  I just logged into box, then into a second SP(getting in on the SSO session), in a second browser tab.  I then log out of my box account which logs me out on their SP, then redirects me to the IdP Logout page, ending my IdP SSO session.  I still have a browser session with the 2nd SP and can continue to use, but if I try to enter any other services (box.com included), I am presented a login page.  This behavior satisfies our logout policy, which is  that just like SSO where you login to 1 service, you have SSO; conversely, if you log out of 1 service, your SSO is ended.

Because Box, Everfi, and others were set up to do local logout only, landing the user on the SP logout page, possibly leaving them with the false impression that their SSO is ended.  Granted these SPs do a decent job on the SP logout page of telling the user to 'close your browser' to be truly logged out.  We preferred they hear it from us.

Josh

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, March 9, 2016 11:06 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: IdPv3 SLO redirect request failures

On 3/9/16, 1:02 PM, "users on behalf of O'Dowd, Josh" <users-bounces at shibboleth.net on behalf of Josh.O'Dowd at mso.umt.edu> wrote:



>> And what is the message to the user?
>
>Feel free to take a look.

You underatand that doesn't work either, right? Closing the browser does nothing anymore.

You would have to tell them to clear their browser history (we really mean cookies, but users see it as all one thing).

We have a KB article I link to on this [1].

-- Scott

[1] https://osuitsm.service-now.com/selfservice/kb_view.do?sys_kb_id=c591b3680a0a3c05014c37aec7538c29

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net