Proposed erratum resolution for PE8

[Thomas Wisniewski <Thomas.Wisniewski@entrust.com>]

Title: Message

Hi, here is proposed text for PE8.

 

 

PE8: SLO and NameID termination

[SAMLBind]

Replace the last sentence in 2479-2480 (section 3.6.3) with:

"In general it SHOULD NOT invalidate any active session(s) of the principal for whom the relationship has been terminated. If the receiving provider is an identity provider, it SHOULD NOT invalidate any active session(s) of the principal established with other service providers. A requesting provider MAY send a <LogoutRequest> message prior to initiating a name identifier termination by sending a <ManageNameIDRequest> message if that is the requesting provider's intent (e.g., the name identifier termination is initiated via an administrator who wished to terminate all user activity). The requesting provider MUST NOT send a <LogoutRequest> message after the <ManageNameIDRequest> message is sent."

 

My intent here is that the MNI protocol should not imply SLO in any way. I.e., if the requester wishes an SLO, it should do so explicity using a <LogoutRequest> message prior to MNI.

Tom.

Thomas Wisniewski
Software Architect
Phone: (201) 891-0524
Cell: (201) 248-3668
 
EntrustÒ
Securing Digital Identities
& Information