SP Initiated Logout with failed IDP logout request

[Cantor, Scott]

On 7/7/21, 11:24 AM, "users on behalf of Bryan Madaras" <users-bounces at shibboleth.net on behalf of bryan.madaras at armssoftware.com> wrote:

> From the perspective of the user they are directly logged back in as they did not have to re-authenticate on
> the IDP.
> Which I thought they would have to when we removed the session from the SP SessionCache and closed the
> browser which should then clear the browser session cookies.

The SP session can't possible have anything to do with the IdP's session, but more to the point your notion of what happens when you close the browser is about 15 years out of date, unfortunately. Session cookies do not go away when the browser closes unless the user chooses that behavior and disables session restore features standard in most browsers.

As matter of "correctness", the SP and IdP both use session cookies fairly exclusively, but it's becoming inevitable that they both need to move to persistent cookies to, ironically, avoid persistence. There's a "right" and a "wrong" though, and this project tends to insist on doing what's "right" technically even when the rest of the world's bugs and bad choices make the result "wrong".

Strictly speaking, however, none of this matters except on shared machines, which are impossible to make safe no matter what we do.

-- Scott