Possibility to revoke sessions when using client storage

[Andrew Morgan]

On Mon, 2 Apr 2018, Cantor, Scott wrote:

> Actually in light of the web service comment, I think you probably can 
> already do this pretty simply with 3.4 anyway, by way of resolving an 
> attribute or attributes via REST and then applying a context-check rule 
> to block service access globally based on the result. It's not specific 
> to 3.4 of course, it's just easier since the REST connector is done.
>
> I'll need to check that the right information is accessible but I think 
> information about the session creation time would be accessible so that 
> you could write a check based on a timestamp coming back.

I was just having this same thought when I read your previous message.  Do 
we actually need SAML Logout (propagated to SPs) or just the ability to 
prevent future re-use of the SSO session?  The solution above is more akin 
to User Lockout because it would be an on-going block, not just 
destruction of the existing SSO session.

I really like this idea...  Since we are querying LDAP anyways, we could 
just test for our "account deactivated" attribute.

Thanks,
 	Andy