Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

The main reason for this feature is that by default, the IdP's session manager is configured not to track or index the sessions created with SPs, because that information also does not fit reliably in a cookie. That makes the single-logout feature unusable since the IdP doesn't know what SPs to communicate with. Turning on the Local Storage feature is necessary but not sufficient to allow at least some form of single logout to work without moving session storage to the server. You also will need to enable a couple of additional session management properties (idp.session.trackSPSessions and idp.session.secondaryServiceIndex). There are two properties because the latter is more a SAML-specific need that may not extend to other protocols in the future.

...