Asynchronous SLO from IDP to SP

[Cantor, Scott]

On 2/15/17, 1:43 PM, "users on behalf of Andrew Morgan" <users-bounces at shibboleth.net on behalf of morgan at orst.edu> wrote:

> Does the equivalent logout processing happen if you go directly to /idp/profile/Logout?

The difference between that endpoint and SAML Logout is that the former means to logout whatever session is owned by the client and the latter means to look up the session based on the LogoutRequest. The main difference is that in the long run the latter allows an administrative logout feature, though we don't have one.

A redirect logout has no response protocol so it's implied that it's "asynchronous" with no response sent to whatever created the redirect.

What happens at either endpoint if a session is identified for logout is the same afterwards.

-- Scott