SP prompting for persistent id expiration?

[Cantor, Scott]

> Apparently, Access Manager has a concept of "defederation":

That dates from the original Liberty Alliance concept of "federation" as account linking. A user was supposed to be in control of the creation of a shared identifier linked to the SP account, and would login to both to do the link. Defederation was the ability to break the link.

In practice, none of that turned out to be useful in the majority of cases and is mostly historical. Even to the extent that it's done, nobody supports any of the SAML protocols involved.

> The team running this server expects the act of "defederation" in thier
> application to contact the our IDP and expire the given user's persistent ID.

It's part of the NameID management protocol, there's a <Terminate/> signal sent with the <NameID> to tell the IdP or SP that the ID should be disabled.

> The feels awfully vendor specific.  Is this a standard SAML thing?

Yes, but we have never supported it, as nobody has ever asked. We also don't, with the very specific exception of persistent IDs in a database, have the ability to do this, since we don't control the state. Generated persistentIDs can't be revoked.

-- Scott