SingleLogout Service Google Apps for education

[Dave Perry]

If it doesn't support SAML logout, well, it just doesn't.
I redirect on google logout to a regular HTML page sat under the IdP's /static/ folder (not fancy, but end user is OK with it).


Dave Perry | eLearning Technologist | eLearning & Libraries | L32 (Library)
Hull College, Queen's Gardens, Wilberforce Drive, Kingston-Upon-Hull, HU1 3DG.
( 01482 381930 (Ext: 2230) | * Dave.Perry at hull-college.ac.uk<mailto:Dave.Perry at hull-college.ac.uk> | www.hull-college.ac.uk<http://www.hull-college.ac.uk/>


Sent via webmail/mobile

* Need a fast response? Contact elearning at hull-college.ac.uk *

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Steve Herrera via users <users at shibboleth.net>
Sent: 16 May 2022 16:51
To: Cantor, Scott <cantor.2 at osu.edu>
Cc: Steve Herrera <sherrera at fsmail.bradley.edu>; Shib Users <users at shibboleth.net>
Subject: Re: SingleLogout Service Google Apps for education


CAUTION: This email originated from outside of the organisation. Do not click links or open attachments unless you recognise the sender and know the content is safe.
- ICT Helpdesk

In the logs, it doesn't throw any errors. Here is what it shows:

2022-05-16 10:46:09,734 - INFO [Shibboleth-Audit.Logout:283] - 2022-05-16T15:46:09.734566Z||||http://shibboleth.net/ns/profiles/logout||||sherrera|||||

2022-05-16 10:46:09,803 - INFO [Shibboleth-Audit.LogoutPropagation:283] - 2022-05-16T15:46:09.803312Z|||google.com/a/REDACTED|http://shibboleth.net/ns/profiles/saml2/logout|https://REDACTED|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_fc7ca430632f77d31c314119f95706b9||||sherrera@REDACTED||<http://google.com/a/REDACTED|http://shibboleth.net/ns/profiles/saml2/logout|https://REDACTED|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_fc7ca430632f77d31c314119f95706b9||||sherrera@REDACTED||>

How do you recommend killing the session when the user hits logout? If Google doesn't support SAML logout, what options should I pursue?

On Mon, May 16, 2022 at 7:08 AM Cantor, Scott <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>> wrote:
On 5/14/22, 4:44 PM, "Steve Herrera" <sherrera at fsmail.bradley.edu<mailto:sherrera at fsmail.bradley.edu>> wrote:

>    The reason I thought it would support it is because Google has a config requesting Sign-out Page URL.  I
> pointed that to our IDP Logout page and it redirects it correctly there.

That's not a SAML logout.

>    Maybe this is expected behavior for the IDP properly killing the session and I just did not know what to
> expect.

Your logs will tell you exactly why it failed, and no, it didn't work.

-- Scott






If you need support for your mental health, out of college hours, please contact the following:
Hull & East Riding - Crisis Team (Adults) Tel: 0800 138 0990 and Children Services Tel: 01482 301701

If you live in a different local authority area please access the following link for mental health services in your local area - https://hubofhope.co.uk/
Other important local services
Hull & East Yorkshire MIND - Tel: 01482 240133
Hull Domestic Abuse Partnership - Tel: 01482 318759
Samaritans - Tel: 116 123
Papyrus - Tel: 0800 068 4141


**********************************************************************
This message is sent in confidence for the addressee
only. It may  contain confidential or sensitive
information.  The contents are not to be disclosed
to anyone other than the addressee.  Unauthorised
recipients are requested to preserve this
confidentiality and to advise us of any errors in
transmission.  Any views expressed in this message
are solely the views of the individual and do not
represent the views of the College.  Nothing in this
message should be construed as creating a contract.

Hull College Group owns the email infrastructure, including the contents.

Hull College Group is committed to sustainability, please reflect before printing this email.
**********************************************************************
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220516/fcfd9a00/attachment.htm>