Shibboleth Developers

["Scott Cantor" <>]

Chad La Joie wrote on 2009-07-12:
> I'll have to discuss it with Scott.  I haven't studied the SLO profile
> enough to say for certain what the IdP needs to retain.

You have to retain the NameID used in the original assertion issued to each
SP. That's the lookup key between the IdP and SP. The SessionIndex is
probably needed if we're populating that to begin with in the assertion,
because normally logout is only meant to apply to a particular set of
sessions.

Transients don't "change" within the context of a particular session, but
are different by definition between SPs, so saving a single NameID isn't
enough.

I don't know whether we "expire" the transient ID mappings now on a
different schedule from the assertion validity, but I probably wouldn't do
that.

But the mapping on the IdP side would have to be from NameID to session in
order to support SP-initiated logout over back channel, if we decided to
support that.

-- Scott

<<attachment: winmail.dat>>