Genetec SingleLogoutService?

[Scott Gilbert]

Hi Scott

Thanks.

Yes, the documentation and discussion of SLO is interesting. Quite a topic.
We did not incorporate it in this version of our IdP or I would be better
versed in it. And we use the CAS plug-in.

Is there a way to use a generic SAML2 url by using
/profile/SAML2/Redirect/SLO to satisfy their assertion requirement? I know
I am grasping at straws here.

For example
https://ucsantabarbara.gsc-cloud.com/genetec/auth/profile/SAML2/Redirect/SLO

This is what exists in their SP metadata which must match what is
configured in the application as OIDC and SAML2 logout URI's.

<SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="
https://ucsantabarbara.gsc-cloud.com/genetec/auth/logout/" />
<SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="
https://ucsantabarbara.gsc-cloud.com/MobileOpenId/logout/" />
<SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="
https://ucsantabarbara.gsc-cloud.com/SecurityCenterOpenId/logout/" />

OIDC and SAML2 logout URI's
https://ucsantabarbara.gsc-cloud.com/genetec/auth/logout/
https://ucsantabarbara.gsc-cloud.com/MobileOpenId/logout/
https://ucsantabarbara.gsc-cloud.com/SecurityCenterOpenId/logout/

I suggested removing the SLO uri's altogether but that is not allowed. And
YES this is ass backwards, supposedly this is what is stopping the
redirection to our LOGIN page.


Scott Gilbert
IAM/Cloud System Administrator
Enterprise Technology Services
University of California Santa Barbara



On Fri, Jul 8, 2022 at 4:07 PM Cantor, Scott <cantor.2 at osu.edu> wrote:

> I'm not sure what you're asking? Vendor's gonna vendor. You can fight
> them, or not, I guess, obviously there's no fundamental reason why SSO and
> SLO have to be intertwined. Some fights are more worth it than others.
>
> The IdP certainly supports logout endpoints and they're enabled by
> default, as well as documented. No, it's certainly not trivial to really
> try and do logout for real, but with a vendor, "your metadata" should be
> confined to whatever you share with them anyway, you needn't view it as a
> global deployment decision.
>
> But if you're asking "is it reasonable to require an SLO endpoint just to
> allow for SSO?", no, clearly not.
>
> -- Scott
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220712/2a46693d/attachment.htm>