shibboleth sp and error/logout templates

Jan Vilhuber JVilhuber at absolute.com
Fri Sep 15 04:00:27 EDT 2017


I'm considering always using the 'Local' logout behavior, removing the 'SAML2' setting. This way, I can present a message to the user, educating them about what it means to Logout in an SSO environment. But to me, the right message would look something like this:
"You've been logged out of ApplicationX. You are still logged into IDP-Y, however, so if you navigate back to ApplicationX you will likely not see a username/password prompt! Please click <here; IDP-Y-Logout-link> to also log out of IDP-Y"

For this to work, I need to know, in the template, which IDP the user used and what the IDP SLO endpoint is. I didn't see any variables that would work for this. Are there any I might have missed or have evaded documentation?

Alternatively, can I configure *2* Logout endpoints? One would do "local" (and display something similar to the above message) and a second one that does 'saml2' behavior? That way my app could call /Shibboleth.sso/LogoutLocal, display a good message with a link to /Shibboleth.sso/LogoutSAML2 that would then also redirect to the IDP (of course if we've logged out and killed the session we no longer know which IDP the user used in the first place, so perhaps this scenario is nonsensical).

Ideas? Thoughts?
Jan



More information about the users mailing list