Single Logout (SLO)

[Muzinich, Mike]

We are fortunate as SP’s we deal with have ‘authentication cookies’ which are session based so closing the browser does require re-authentication.  Disabling SSO for shared machines is intriguing.  Blocking access to SSO is not a standard function of the IDP, rather something custom we would have to develop, correct?

From: users <users-bounces at shibboleth.net> on behalf of "Cantor, Scott" <cantor.2 at osu.edu>
Reply-To: Shib Users <users at shibboleth.net>
Date: Wednesday, July 26, 2017 at 7:54 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: Single Logout (SLO)

On 7/26/17, 10:39 AM, "users on behalf of Muzinich, Mike" wrote:

Thank you for the information.  Considering if one of the SP’s does not follow standards, as shocking as that might be, SLO could
potentially not work, staying with “plastering” the web pages with close your browser to logout seems like a more viable
solution.

All logout attempts will be partial and normally incomplete, that's the best case.

But closing the browser does nothing. Only clearing cookies will accomplish anything in most cases, though it depends on the browser and local configuration.

This is about shared machines; I would consider disabling SSO for shared machines when you know the networks involved, or at least minimize which SPs they can access based on business need.

-- Scott



--
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170726/35ae6b04/attachment.html>