Thanks, Scott. I'll disable asynchronous logout.
<br/><br/>On 4/2/2013 10:10 AM, Cantor, Scott E. [via Shibboleth] wrote:
<div class='shrinkable-quote'><br/>> On 4/2/13 8:36 AM, "bmontgomery" <[hidden email]
<br/>> </user/SendEmail.jtp?type=node&node=7585791&i=0>> wrote:
<br/>>
<br/>> >We have the Shib SP running on IIS, and we're trying to integrate the
<br/>> >logout
<br/>> >functionality with ADFS. I've seen plenty of things out there (including
<br/>> >Shibboleth SP docs) which say that ADFS does not like the extensions
<br/>> >(which
<br/>> >define asynchronous logout) that are put into the XML of the logout
<br/>> >request,
<br/>> >and it throws an error when the user is redirected to ADFS from Shib. I'm
<br/>> >of
<br/>> >the opinion that this is a Microsoft bug, but MS seems to think
<br/>> otherwise.
<br/>>
<br/>> MS is wrong. Extensions in SAML are optional by definition. This is
<br/>> explicitly called out in the standard. This is not just opinion, as it's
<br/>> not an ambiguous area of the standard.
<br/>>
<br/>> >
<br/>> >
<br/>> >>From what I'm reading, I can just put asynchronous="false" on the
<br/>> >LogoutInitiator element to work around this problem. I'm wondering if
<br/>> that
<br/>> >is the right thing to do. What effect does this have on Shib IdP's (and
<br/>> >other IdP's) which integrate with us?
<br/>>
<br/>> The only software that will ever do anything with that extension is a
<br/>> Shibboleth IdP version that isn't out yet.
<br/>>
<br/>> -- Scott
<br/>>
<br/>>
<br/>> --
<br/>> To unsubscribe from this list send an email to [hidden email]
<br/>> </user/SendEmail.jtp?type=node&node=7585791&i=1>
<br/>>
<br/>>
<br/>> ------------------------------------------------------------------------
<br/>> If you reply to this email, your message will be added to the discussion
<br/>> below:
<br/>> <a href="http://shibboleth.1660669.n2.nabble.com/Asynchronous-Logout-with-ADFS-tp7585790p7585791.html" target="_top" rel="nofollow" link="external">http://shibboleth.1660669.n2.nabble.com/Asynchronous-Logout-with-ADFS-tp7585790p7585791.html</a><br/>>
<br/>> To unsubscribe from Asynchronous Logout with ADFS, click here
<br/>> <<a href="" target="_top" rel="nofollow" link="external">
<br/>> NAML
<br/>> <<a href="http://shibboleth.1660669.n2.nabble.com/template/NamlServlet.jtp?macro=macro_viewer&id=instant_html%21nabble%3Aemail.naml&base=nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.view.web.template.NodeNamespace&breadcrumbs=notify_subscribers%21nabble%3Aemail.naml-instant_emails%21nabble%3Aemail.naml-send_instant_email%21nabble%3Aemail.naml" target="_top" rel="nofollow" link="external">http://shibboleth.1660669.n2.nabble.com/template/NamlServlet.jtp?macro=macro_viewer&id=instant_html%21nabble%3Aemail.naml&base=nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.view.web.template.NodeNamespace&breadcrumbs=notify_subscribers%21nabble%3Aemail.naml-instant_emails%21nabble%3Aemail.naml-send_instant_email%21nabble%3Aemail.naml</a>>
<br/>>
</div><br/>
<br/><hr align="left" width="300" />
View this message in context: <a href="http://shibboleth.1660669.n2.nabble.com/Asynchronous-Logout-with-ADFS-tp7585790p7585792.html">Re: Asynchronous Logout with ADFS</a><br/>
Sent from the <a href="http://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html">Shibboleth - Users mailing list archive</a> at Nabble.com.<br/>