<html><body>
<p><font size="2" face="sans-serif">Dear All!</font><br>
<br>
<font size="2" face="sans-serif">I managed to configure SLO with Shibboleth 3.2.0, and I would like to share two observations:</font><br>
<font size="2" face="sans-serif">1. In case of SP-Initiated logout, the IdP view does not tell anything about the SP where the logout was initiated.</font><br>
<font size="2" face="sans-serif">2. Even if the user answers 'No' for the 'Would you like to attempt to log out of all services ....?' question, IdP session will be terminated, and no more logout can be initiated from other SPs.</font><br>
<br>
<font size="2" face="sans-serif">-----------------------------------------------</font><br>
<br>
<font size="2" face="sans-serif">A bit more verbose description:</font><br>
<br>
<font size="2" face="sans-serif">ad 1. Let's say that the user is logged in on SP1, SP2 and SP3. Once the user clicks on logout on SP1, an SP-Initiated SLO takes place and the user will be redirected to an IdP view.</font><br>
<font size="2" face="sans-serif">On this view, the 'Would you like to attempt to log out of all services ....?' question appears. Under the question SP2 and SP3 are listed.</font><br>
<font size="2" face="sans-serif">My problem is that this IdP view does not tell anything about what happened with SP1. This can be confusing for the user.</font><br>
<br>
<font size="2" face="sans-serif">In comparison, this part is implemented on a slightly different way in SimpleSAMLphp IdP.</font><br>
<font size="2" face="sans-serif">Namely, after an SP-Initiated SLO, the IdP view shows a prominent 'You have logged out from SP1' message and under the message it shows the question with the list of SPs.</font><br>
<br>
<font size="2" face="sans-serif">In my opinion, it would be useful if Shibboleth could render a 'You have logged out from SP1' kind of message above the 'Would you like to attempt to log out of all services ....?' question.</font><br>
<br>
<font size="2" face="sans-serif">-----------------------------------------------</font><br>
<br>
<font size="2" face="sans-serif">ad 2. Let's say that the user is logged in on SP1, SP2 and SP3. User logs out from SP1 and arrives to the 'Would you like to attempt to log out of all services ....?' question.</font><br>
<font size="2" face="sans-serif">What if the user answers 'No' for the question because she needs to finish some work on SP2? In one hour, the user finishes work on SP2 and clicks logout.</font><br>
<font size="2" face="sans-serif">IdP will not render any view because it will detect that</font><br>
<font size="2" face="sans-serif"> Profile Action ProcessLogoutRequest: No active session(s) found matching LogoutRequest</font><br>
<br>
<font size="2" face="sans-serif">and it will send back a logout response:</font><br>
<font size="2" face="sans-serif"><saml2p:Status></font><br>
<font size="2" face="sans-serif"> <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Requester"></font><br>
<font size="2" face="sans-serif"> <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:UnknownPrincipal"/></font><br>
<font size="2" face="sans-serif"> </saml2p:StatusCode></font><br>
<font size="2" face="sans-serif"> <saml2p:StatusMessage>An error occurred.</saml2p:StatusMessage></font><br>
<font size="2" face="sans-serif"></saml2p:Status></font><br>
<br>
<font size="2" face="sans-serif">By visiting the <a href="http://localhost/idp/profile/Logout">http://localhost/idp/profile/Logout</a>, IdP renders a view with 'The logout operation is complete, and no other services appear to have been accessed during this session.'</font><br>
<font size="2" face="sans-serif">But in reality, SP3 is still logged in!</font><br>
<br>
<font size="2" face="sans-serif">In comparison, SimpleSAMLphp IdP behaves differently. Namely, after SP initiated logout from SP1, IdP renders a view with the question. If the user answers 'No', IdP does not terminate the IdP session.</font><br>
<font size="2" face="sans-serif">So, if the user initiates a logout from SP2, the IdP renders a view telling that 'You logged out from SP2', and raises the question again if you want to logout from the rest of the services, and lists the remaining SP3.</font><br>
<br>
<font size="2" face="sans-serif">By checking the log, it looks to me that Shibboleth SLO flow destroys the IdP session before the user clicks Yes/No. Is this on purpose?</font><br>
<font size="2" face="sans-serif">[net.shibboleth.idp.saml.saml2.profile.impl.ProcessLogoutRequest:274] - Profile Action ProcessLogoutRequest: LogoutRequest matches IdP session 63aa80be80171333ae3111f81d6225212b005f830bcbf43ae48057e8b0988fec</font><br>
<font size="2" face="sans-serif">[org.opensaml.storage.AbstractMapBackedStorageService:208] - Deleted context '63aa80be80171333ae3111f81d6225212b005f830bcbf43ae48057e8b0988fec'</font><br>
<font size="2" face="sans-serif">[net.shibboleth.idp.session.impl.StorageBackedSessionManager:552] - Destroyed session 63aa80be80171333ae3111f81d6225212b005f830bcbf43ae48057e8b0988fec</font><br>
<br>
<font size="2" face="sans-serif">From my point of view, it would be better to terminate the IdP session depending on the user's Yes/No answer. The current implementation might be confusing from a user point of view, and also for SP operators.</font><br>
<br>
<font size="2" face="sans-serif">Let me know if you need more details!</font><br>
<br>
<font size="2" face="sans-serif">Any feedback is warmly welcome!</font><br>
<br>
<font size="2" face="sans-serif">Thank you!</font><br>
<font size="2" face="sans-serif">Peter</font></body></html>