Shib SP administrative logout

[Cantor, Scott]

On 3/3/21, 3:21 AM, "users on behalf of Silke Meyer" <users-bounces at shibboleth.net on behalf of smeyer at dfn.de> wrote:

>    Is there any documentation of Shibboleth SP administrative logout? 

No, I forgot it existed.

>    Especially on how to pass the REMOTE_USER or the Name Identifier to the 
>    LogoutInitiator instead of the session ID?

That isn't supported. It takes a "session" parameter with the session ID, and the only settings are what's in the file already, just the ACL to limit use (I just looked).

If you want to use a NameID, that's just SAML logout, there's no reason to implement that again. The reason SAML logout is supposed to be signed is because it's essentially already an administrative logout. The problem is that back channel logout works even less well than front channel does and the IdP has never gotten the feature added to trigger it.

The only real "feature" this added was an explicit revocation cache to (sort of, mostly, not really) prevent session recovery, that's more or less the precondition to supporting administrative logout.

-- Scott