<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Sat, Jan 17, 2015 at 12:25 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span class="">> Ok, well in that case can I ask that the idp (or how to configure the IdP ) to<br>
> instead perform the logout but not return to the sp if it's configured for client<br>
> side sessions? Perhaps just terminate on the local logout page?<br>
<br>
</span>Is the SP including the Async extension? If so, I may have either been unable to get it to stop returning, or there's a bug.<br></blockquote><div><br></div><div>No, the SP is not including Async (Shib SP 2.4.3). So, looks like from the docs I need to update that SP to 2.5.x and configure it to do so. <br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
If not, that was meant to be the way to ask for that. As a more brute force choice, you can override an error event so that it becomes a local error, but I'll have to go digging to see what the event is in this case.<br></blockquote><div><br></div><div>Ok, so the v3 IdP, by default, is set to use client-side sessions, the auto-generated metadata has the logout endpoints advertised, and the docs currently written seem to encourage the deployer to stick with client-side sessions. I would very much appreciate it if the IdP would do something more in this case than sending the SP the generic message of "An error has occurred." Ideally, the IdP would either kill the session cookies in the browser and display some kind of "you only think you've SLO'd" message or something a little more detailed would show up in the process log / be sent to the SP describing "client-side sessions are not compatible with logout".</div><div><br></div><div>I am interested though in the specific event to trap in the meantime. </div><div><br></div><div>Thanks</div><div><br></div><div>Dave</div></div><div><br></div>-- <br><div class="gmail_signature">David Langenberg<div>Identity & Access Management</div><div>The University of Chicago</div></div>
</div></div>