How to configure single logout redirect

[Nate Klingenstein]

Excuse me, this answer is probably off somewhat.  I don't see anything in
4.4.3.5 or 4.4.4 talking about the use of a RelayState.  I guess an IdP
could hypothetically include a RelayState in step 5 that the
logout-initiating SP could redirect the user to, although I think that
would be unusual.

On Mon, Jul 5, 2021 at 4:18 PM Nate Klingenstein <ndk at sudonym.me> wrote:

> Egobrc,
>
> The coordinating entity in SAML 2.0 Logout is the IdP, whether
> front-channel or back-channel.  The goal is to ensure that all sessions
> associated with the IdP session are cleared, so the IdP orchestrates the
> process and is intended to be the ultimate landing point.  See 4.4:
>
> https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf
>
> The RelayState in a response can tell the SP additional information to
> send back to the IdP to complete logout, but it's up to the IdP to
> determine the value of the RelayState and to use it when returned.  The SP
> is not permitted to modify it.  It looks like this coming out of a 3.x
> IdP(I don't have a 4.x one on hand to look at):
>
> *RelayState*: corr:1625500968_47db
>
> After the logout process itself is complete, the profile says nothing
> about what to do or display to the user.  You could modify logout.vm at the
> IdP to (have the option to, or forcibly) finish with a JavaScript redirect
> to a login page after the proceed event is called.  That would be the easy
> way.
>
> Take care,
> Nate.
>
> On Mon, Jul 5, 2021 at 3:42 PM egobrc at gmail.com <egobrc at gmail.com> wrote:
>
>> Hi everybody, I am trying to understand how the SingleLogoutService
>> works with Http-redirect option
>> (
>> https://wiki.shibboleth.net/confluence/display/SP3/SAML+2.0+SingleLogoutService
>> ) .
>>
>> That wiki page states that: If the message is a response, then the SP
>> completes the logout operation by redirecting to the browser to a
>> location preserved by relay state, if any, or the globalLogout
>> template is displayed.
>>
>> My question is: is it possible to configure the final redirect
>> location? E.g. pointing the user to a login page? I did not understand
>> the statement "redirecting to the browser to a location preserved by
>> relay state, if any".
>>
>> Thanks
>> --
>> For Consortium Member technical support, see
>> https://wiki.shibboleth.net/confluence/x/coFAAg
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210705/a7976f6a/attachment.htm>