<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Yes, that property will completely turn off the session layer.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We did this originally, but since we’re still using the built-in password and MFA flows for non-browser connections, we wanted to still be able to offer non-0 session length for those clients that are smart enough to store the session cookie.
We ended up setting the timeout and lifetime for the SAML proxy authentication flow to 1 second (since it must be a value greater than 0). That basically disabled SSO for browsers but not for ECP clients, and we turned the session layer back on.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Keith<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> users <users-bounces@shibboleth.net> <b>On Behalf Of
</b>Jeffrey Williams via users<br>
<b>Sent:</b> Wednesday, January 19, 2022 3:46 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Cc:</b> Jeffrey Williams <jfwillia@uncg.edu><br>
<b>Subject:</b> Re: Shibboleth Proxy to Azure: Completing logout.<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Wed, Jan 19, 2022 at 4:01 PM Cantor, Scott <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal">On 1/19/22, 3:30 PM, "Michael Grady" <<a href="mailto:mgrady@unicon.net" target="_blank">mgrady@unicon.net</a>> wrote:<br>
<br>
> And if you are not trying to propagate logout anyways, another option might be you simply do not have the<br>
> Shib IdP keep a session in the first place, and list an Azure AD logout endpoint that does not require a SAML<br>
> logout message (just like the Shib IdP's profile/Logout endpoint) as the logout endpoint when you configure<br>
> the SP with the Shib IdP. (Assuming Azure AD has such a logout endpoint.)<o:p></o:p></p>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I had not considered dropping Shib IDP session creation as a whole. That seems like a pretty elegant solution to the problem. Is configuring for that as straightforward as setting ip.session.enabled=false in idp.properties, or is there
anything else that'd need to be done?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I remembered looking at a meta refresh redirect to Azure, but found that the url that Azure SSO uses is indeed SAML-based(<a href="https://urldefense.com/v3/__https:/docs.microsoft.com/en-us/azure/active-directory/develop/single-sign-out-saml-protocol__;!!DZ3fjg!q6ZeSkLbpdguawcb70INBmzFGe8XcQyIRZFeDgqjytEe4KoOdZJ34oOCJxInFwJ9Rw$">https://docs.microsoft.com/en-us/azure/active-directory/develop/single-sign-out-saml-protocol</a>).
Does that make this sort of logout a feature request or is there some way to craft and send the samlp:LogoutRequest in the template?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal">Whenever you're dealing with something not in the metadata, you have something "unmanaged", and that should never be directly pointing to a piece of software you don't control (as in, the IdP could change that URL for some reason, but a
script you own lives where you decide it does).<br>
<br>
I use /cgi-bin/logout.cgi on my IdP servers for that, and I never allow direct references to /idp/profile/Logout.<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://urldefense.com/v3/__https:/shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!DZ3fjg!q6ZeSkLbpdguawcb70INBmzFGe8XcQyIRZFeDgqjytEe4KoOdZJ34oOCJxKuwhKpAQ$" target="_blank">
https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal"><br clear="all">
<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">-- <o:p></o:p></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal">Jeffrey Williams <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Identity & Access Engineer<br>
Identity & Access Services<br>
<a href="https://urldefense.com/v3/__https:/its.uncg.edu__;!!DZ3fjg!q6ZeSkLbpdguawcb70INBmzFGe8XcQyIRZFeDgqjytEe4KoOdZJ34oOCJxJzo9Z7WA$" target="_blank">https://its.uncg.edu</a><o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="border:solid windowtext 1.0pt;padding:0in"><img border="0" width="100" height="100" style="width:1.0416in;height:1.0416in" id="Picture_x0020_1" src="cid:~WRD0001.jpg" alt="Image removed by sender."></span><o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>