Info about SLO on IPDv4 - no final logout response

[Manuel Haim]

Hi,

correct my if I'm wrong, but didn't the SP asynchronous extension just 
signal to the IdP that the IdP should not redirect back to the SP global 
logout status page after SLO?

As far as I remember, the IdP does not send a SAML logout request to the 
initiating SP in any case, and the initiating SP (Shibboleth) does not 
trigger the SOAP logout endpoint (if configured) of the web application.

So, as Scott said, it's the initiating web application's task to first 
terminate the web application session, then trigger SLO via the SP 
(Shibboleth).

Manuel


Am 10.01.23 um 15:11 schrieb Cantor, Scott via users:
>> I expected the idp to send a logout response to the SP_A to conclude, but this
>> doesn't happen.
> 
> Shibboleth SPs may be issuing logout requests with the Asynchronous extension element that tells an IdP it doesn't need to respond.
> 
> SPs are obligated to take care of all clean up before issuing a logout request to an IdP, so it is superfluous to even bother with a response and the extension allows that to be signalled.
> 
> -- Scott
> 
> 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5421 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20230111/c047c918/attachment.p7s>