force termination of SSO session?

[John C. Pfeifer]

You could probably make a more sophisticated context check rule that doesn’t require a restart. For instance, in our LDAP, we have defined a multivalued attribute for storing arbitrary “status” values (for instance, there is one that prevents the password from being changed). One could add a “block-sso” value to that attribute for the user that you want to lock out and have the condition in the context intercept include a check for that value.

//
John Pfeifer
Division of Information Technology
University of Maryland, College Park

> On Jul 22, 2021, at 8:14 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> 
> On 7/22/21, 5:22 AM, "users on behalf of Peter Schober" <users-bounces at shibboleth.net on behalf of peter.schober at univie.ac.at> wrote:
> 
>>   There's the account lockout feature:    
>>   (I'd expect this to prevent getting new assertions sent to any SPs.)
> 
> It does not, that's authentication only.
> 
> The IdP does not support administrative logout.
> 
> The closest to "terminating" a session is installing a context check rule based on username and restarting all the servers, which is obviously not what anybody would view as a practical solution, but it's all there is.
> 
> -- Scott
> 
> 
> -- 
> For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net