<div dir="ltr"><div><div><div>That's a really good news to me. I am using principalName as the NameID.<br><br></div>Now the issue I am seeing is that if the same user login to two browsers, in the second browser, he cannot logout correctly, while in the first browser, it works.<br>
<br></div>If I switch to transient ID, will this issue be resolved?<br><br></div>Yaowen<br><br></div><div class="gmail_extra"><br clear="all"><div>Yaowen</div>
<br><br><div class="gmail_quote">On Thu, Aug 29, 2013 at 3:42 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">On 8/29/13 6:34 PM, "Yaowen Tu" <<a href="mailto:yaowen.tu@gmail.com">yaowen.tu@gmail.com</a>> wrote:<br>
<br>
>Actually I am using non-transient NameID.Does it make any difference<br>
>during single logout compared with transient NameID?<br>
<br>
</div>The session cache has design limitations (call them bugs) that cause it to<br>
overwrite the NameID->SP mapping of the first SP with the second (and so<br>
on).<br>
<br>
It was not designed with logout in mind, and isn't compatible with the<br>
requirements that correctly implementing the protocol would take. Not that<br>
the protocol isn't a mess, it is, but given how it works, you have to have<br>
a perfect record of the NameID issued to every SP.<br>
<br>
With a transient, the mappings don't overlap.<br>
<div class="HOEnZb"><div class="h5"><br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>