Shibboleth Developers

[Scott Cantor <>]

André Cruz wrote:
> So what can we expect for 2.0, just front-channel requests?

No, I'm doing back channel, but I'm not going to try and make that work 
right now if I have to define a whole other protocol just to satisfy the 
applications. Redirecting to the app on the wrong-channel is fine, 
that's expected, but on the back-channel, that just seems unreasonable.

If the commercial products support it, then I'll revisit it, or somebody 
else can. It's not that hard to write an handler in 2.0, they're rather 
simple.

> The remote  termination of the SP session is enough for me at least. 
That was my
> biggest problem with the custom logout mechanism used here with 1.3.

You know there's a hook in 1.3 to terminate the SP session, right? It's 
at /Logout by default. It doesn't involve the IdP, but it clears the SP.

-- Scott