handling of multiple SP logout

["Kyle Meadors" <kyle@drummondgroup.com>]

SSTC,

 

Within this year’s SAML IOP test event, we are testing IdP logouts of multiple SPs on a session, including a scenario of a partial logout. In our test, the arrangement is 2 SPs authenticated with an IdP on the same session. For the partial logout scenario, SP-B terminates their local session but does not notify the IdP. SP-A then starts the SLO, sends the LogoutRequest to the IdP which communicate this to SP-B. Some questions we have are:

 

1. If the local session is ended at SP-B, is the proper status Responder to the IdP or should be Success? If Success, how else should SP-B be “configured” to return a non-Success status apart from ending is local session?

2. If SP-B does return a non-Success status to the IdP, what is the status in the LogoutResponse from the IdP back to SP-A? Success/PartialLogout? Responder/PartialLogout? Success?

 

Kyle Meadors

Drummond Group Inc.

Principal, Test Process

817-709-1627

kyle@drummondgroup.com

 

Calendar: http://tinyurl.com/KyleMeadors-DGI-Calendar

 

* * * * * * * * * * * * * * * * * * * * * * * *

CONFIDENTIALITY DISCLAIMER

This email, including attachments, is confidential and proprietary. It constitutes exclusive communication solely to the addressee. Any entity other than the intended addressee is prohibited from use of this communication for any purpose. This email, including attachments, may not be distributed, whole or in part.

* * * * * * * * * * * * * * * * * * * * * * * *