Info about SLO on IPDv4 - no final logout response

[Cantor, Scott]

> correct my if I'm wrong, but didn't the SP asynchronous extension just
> signal to the IdP that the IdP should not redirect back to the SP global
> logout status page after SLO?

That is not correct. It's a signal to skip the logout response. The SP happens to redirect to that page itself after receiving a logout response.

> As far as I remember, the IdP does not send a SAML logout request to the 
> initiating SP in any case, and the initiating SP (Shibboleth) does not 
> trigger the SOAP logout endpoint (if configured) of the web application.

The IdP always, when it can, sends back a logout *response* to the initiating SP if it is able and does not see the extension.

It just happens that there is no real value to that. The only point to a response is SP to IdP, to signal success or failure, but even that is really moot since failure is the norm and it's impossible to report that out accessibly.

V5 will hide all that by default, Google will make it impossible to do in any case one of these days, and eventually all that reporting logic will be ripped out. It was a clever design, but it has no future.

-- Scott