Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: 2 typos

...

Another UI issue occurs during SP-initiated SLO. In this case it is the SPs responsibility to provide the final indication to the user about the success or failure of SLO. However, the amount of information that the SP gets back from the IdP is very limited; a URI that either indicates complete success or one that indicates some failure in the process. In the case where SLO fails the SP will have little information with which to tailor what it displays to the user since it will not know th the cause of the failure. In almost all failure cases the sensible thing would be to tell the user to close their browser. This provides a way to deal with this issue, but it's not very elegant.

...

The use of the back-channel binding can mitigate almost all the issues presented so far (except the lack of failure information in the SLO response during SP-initiated logout). However, like in the case with administrative logout over a front-channel binding the user's session cookie is not available to the application and so the same issues are present; in ability inability to look up the user's session and destroy it.

...