<div dir="ltr"><div><div><div><div><div><div>So we were trying to provide a more complete SLO feature in 2.4.0 but found that the design was incomplete, and then just left the existing code in it as long as it doesn't break any existing feature?<br>
<br>Is it related to this note in the SLO wiki?<br><br>Due to a design limitation in this version, the IdP cannot access more
than one session at a time for a given subject identifier. This works
okay with transient or directed/persistent identifiers, but limits the
IdP's ability to terminate all of the sessions associated with an
identifier even if that might be useful. Secondly, because of this
limitation, the <code>SessionIndex</code> attribute in SAML is ignored.<br><br></div>One more case I want to confirm. Continuing with the scenario in my origianl post:<br></div>1. After "Administrator" login to Firefox first and then Chrome.<br>
</div>2. Now "Administrator" try to do Single Logout on Fireforx, will IdP get the session of Chrome and clean that session?<br></div>3. Now "Administrator" try to SSO on Firefox, it will still work without password, is it?<br>
<br></div>Sorry I should try it by myself, but unfortunately I don't have a SLO enabled SP to try right now, but I will try it later. Just hoping that I can get an answer about that now so that I have a better understand about what we have for IdP 2.4.0.<br>
<br></div>Yaowen<br><br></div><div class="gmail_extra"><br clear="all"><div>Yaowen</div>
<br><br><div class="gmail_quote">On Thu, Apr 25, 2013 at 4:11 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">On 4/25/13 6:52 PM, "Yaowen Tu" <<a href="mailto:yaowen.tu@gmail.com">yaowen.tu@gmail.com</a>> wrote:<br>
><br>
>But what I don't understand if that one index may represent multiple<br>
>sessions, for example in my previous example, IdP has added index<br>
>"administrator" to two different sessions. The later one will replace the<br>
>previous one in the SessionStore, then the only<br>
> way to retrieve the old session is through session-id, not through other<br>
>index. Am I understanding correctly? Did I miss anything on it?<br>
<br>
</div>No; it's broken.<br>
<div class="im"><br>
>Then what is the purpose of these different kinds of index for each<br>
>session?<br>
<br>
</div>Trying to handle logout without ever implementing it and determining the<br>
design was incomplete.<br>
<br>
The only reliable session lookup is by cookie. Nothing else will work<br>
predictably.<br>
<br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br></div>