<div dir="ltr">Thanks Scott from promptly answering my quesitons. Appreciate your help.</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Apr 25, 2013 at 11:19 AM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">On 4/25/13 12:10 PM, "Cantor, Scott" <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<br>
<br>
>On 4/25/13 11:59 AM, "Sam Jacob" <<a href="mailto:skjacob@gmail.com">skjacob@gmail.com</a>> wrote:<br>
><br>
>>after SP's "Shibboleth.sso/Logout", does the user have to close the<br>
>>browser to enforce a logout?<br>
><br>
>There is no fixed answer to that question, it depends on a host of<br>
>factors. In many cases, closing the browser will have no additional effect<br>
>anyway, and as I said, there is no single behavior invoked by that<br>
>handler. It runs a set of logout initiators as configured and what the<br>
>SAML2 handler does depends on the IdP and protocol. And none of that<br>
>addresses the application session.<br>
<br>
</div>I can add, in response to that direct, isolated question, that if you're<br>
talking about a standard Shibboleth IdP and SP, that there is absolutely<br>
nothing done at the IdP when you run that handler. The IdP until 2.4 had<br>
absolutely no features involving logout.<br>
<br>
Assuming that the vast majority of IdPs do SSO, then obviously yes, the<br>
user would have to close the browser. And that won't matter either, with<br>
the most popular browsers.<br>
<div class="HOEnZb"><div class="h5"><br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br>Sam Jacob
</div>