Question on logout ending shibboleth session

[Andrew Morgan]

On Wed, 20 Dec 2017, Andrew Rosendahl wrote:

> Thanks in advance for help on the following:
>
> Upon logout of 3rd party applications that authenticate through the
> shibboleth, typically the browser opens a logout window that (as I
> understand it) kills the session on the shibboleth side.  But if this
> browser window is prevented from opening the session remains alive until
> the session timeout (1hr) is reached.
>
> Is there another mechanism to kill the session (like a post request) other
> than via this logout browser window?

Have you read this?

   https://wiki.shibboleth.net/confluence/display/IDP30/LogoutConfiguration

There is the SAML spec way to do logout via messages to the SingleLogout 
endpoints (which can be back-channel SOAP calls, if the IDP supports it).

If you're not using SAML SingleLogout, then you can do whatever you want 
because there is no standard way to handle logout.  It's quite common for 
Service Providers to ask for a "logout URL" which they will redirect the 
user to after performing application logout.

If you try to embed the logout URL into an iframe or something clunky like 
that, you'll probably end up with problems as a result of the browser 
security model.

 	Andy