Attribute checking based on sp location

[SAMUELE RILLI]

2016-10-16 16:44 GMT+02:00 Peter Schober <peter.schober at univie.ac.at>:
>
> Not without changing identity at the IDP (or picking another IDP), so
> as Scott said, logout and/or user-switching at the IDP would need to
> be involved.


I set the Apache ErrorDocument with a custom page which redirects the
browser to the sp local logout page; the redirect url includes, in the
query string, the return parameter pointing to the location the user was
trying to access, and it looks like this:

*https://my.sp.url/Shibboleth
<https://my.sp.url/Shibboleth>.sso/Logout?redirect=https://my.sp.url/admin*

However, this works if only the local logout is enabled: when global logout
is enabled, redirecting to that url will also involve the idp and the sp
cannot get the UI control back.
Since my sp must provide both logouts, is it possible to have a url that
performs local logout only?
My current sp logout config:
<Logout>SAML2 Local</Logout>

Do I need to explicitly set two different LogoutInitiators?

Thanks again
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161018/7aaec828/attachment.html>