Shibboleth Developers

["Scott Cantor" <>]

> If we thought this happened a lot, we might think that there needs to be a

> UI at the IdP for an IdP user to pick an SP and say "forget my current 
> ePTID with this one".  I don't think we need this, though.  I think the 
> "de-federation" support that Scott mentions in SAML 2 would be initiated 
> by UI at the SP (but I could be wrong about that).

I think Liberty IdPs are supposed to allow users to manage their
federations, so it's usually supported on both ends.

It's fairly important to maintain at least a near-term history of old values
because until all sessions are purged, an SP might still send a message
pertaining to one, e.g. a logout.

-- Scott