SingleLogout Service Google Apps for education

[Cantor, Scott]

On 5/16/22, 11:52 AM, "Steve Herrera" <sherrera at fsmail.bradley.edu> wrote:

>    In the logs, it doesn't throw any errors

That just means it got nothing back from the propagation and that URL is not the apropriate one (which is likely because there isn't one). You shoudn't include it in the metadata, that's not going to be helpful.

>    How do you recommend killing the session when the user hits logout? If Google doesn't support SAML
> logout, what options should I pursue? 

Asking them to support it (and obviously, no, I don't expect them to, they'd likely botch it if they tried anyway).

The real recommendation is to accept that logout will never work to any significant degree. If you can't sell that locally, then you have an intractable problem. I started out very strongly making that clear on my campus to prevent any blowback later. I told them either they accept that, or we don't deploy SSO, their choice.

I've since rolled out support for logout *where it's possible* as an opt-in feature so we don't end up with lots of pointless attempts that don't do anything, and not a single app owner even wants to take me up on it.

-- Scott