<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I'd like to spawn another thread from this SLO discussion based on a comment that Prog made:<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">If you want to implement <b>global logout</b> (logout user from all active sessions (IdP, SP, applications he authenticated to) things will grow more complicated rapidly or
<b>even impossible</b>, depending strongly on your <b>level of control over all the servers</b> involved.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">So, I’d like to ask what others are doing in the situation where you want to attempt global logout but you do not have control over all of the applications. We have a long established practice of attempting to logout all sessions –
IDP, SP, and applications on logout in order to avoid any possibility of a hijacked sessions exposing sensitive data.
<o:p></o:p></p>
<p class="MsoPlainText">But, we have an increasing number of outsourced applications over which we have no control and often having an application session that persists when the SP session has been ended. This is making our global logout attempt to fall more
and more into the “even impossible” category.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">How are others handling this kind of scenario? <o:p></o:p></p>
<p class="MsoPlainText">Is the notion of SLO – particularly in a multi-vendor hodge-podge non-homogenous mess of applications – truly altogether impossible as the Shibboleth docs repeatedly imply?
<o:p></o:p></p>
<p class="MsoPlainText">If so, what are the ways that institutions (educational particularly, since that is our interest) are using to protect against data exposure by sessions left open?<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Input appreciated.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Ted F. Fisher<o:p></o:p></p>
<p class="MsoPlainText">Bowling Green State University<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-----Original Message-----<br>
From: users-bounces@shibboleth.net [mailto:users-bounces@shibboleth.net] On Behalf Of Prog<br>
Sent: Friday, November 28, 2014 12:42 PM<br>
<br>
</p>
<p class="MsoPlainText">Hi,<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">...<o:p></o:p></p>
<p class="MsoPlainText"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoPlainText">If you want to implement global logout (logout user from all active sessions (IdP, SP, applications he authenticated to) things will grow more complicated rapidly or even impossible, depending strongly on your level of control over all
the servers involved.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Regards,<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Michael<o:p></o:p></p>
<p class="MsoPlainText">--<o:p></o:p></p>
<p class="MsoPlainText">To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
<span style="color:windowtext;text-decoration:none">users-unsubscribe@shibboleth.net</span></a><o:p></o:p></p>
</div>
</body>
</html>