Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 3 Current »

Advanced Configuration

Note, this is an advanced configuration feature. Most deployments can rely on the shorthand elements.

The SAML 2.0 logout handler implements the SAML 2.0 Browser Single Logout profile. The incoming message may be a <samlp:LogoutRequest> or <samlp:LogoutResponse>.

If the message is a request via a front-channel binding, then the following steps are performed. If an error occurs at any point, an effort is made to respond to the requesting IdP with a <samlp:LogoutResponse>containing the error.

  1. Verification of the information in the request against the active session is done.
  2. Any of this user's sessions being logged out other than the active session are removed from the cache.
  3. Front and back-channel application notification loops are executed.
  4. A <samlp:LogoutResponse> is returned to the requesting IdP. The status indicates whether the SP believes that the logout completely succeeded.

If the message is a request via a back-channel binding, then the following steps are performed:

  1. The request content is used to obtain a list of applicable sessions to remove.
  2. The sessions are removed.
  3. The back-channel application notification loop is executed.
  4. A <samlp:LogoutResponse> is returned to the requesting IdP. The status indicates whether the SP believes that the logout completely succeeded.

If the message is a response, then the SP completes the logout operation by redirecting to the browser to a location preserved by relay state, if any, or the globalLogout template is displayed.

The following Binding values are supported:

  • urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
  • urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
  • urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign
  • urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact
  • urn:oasis:names:tc:SAML:2.0:bindings:SOAP

Attributes

The following may be specified for all Single Logout protocols and bindings

Name

Type

Req?

Default

Description

Location

relative path

Y


The location of the handler (when combined with the base handlerURL). This is the location to which an IdP sends messages using whatever protocol and binding it shares with the SP. Each combination of SLO protocol and binding is installed at a unique location to improve efficiency.

Binding

URI

Y


Identifies the protocol binding supported by the handler. Bindings describe how the message is packaged by the IdP (or by the browser in some cases) for consumption by the handler.

notifyWithoutSession 3.1

Boolean


false

When true, the front-channel notification feature is enabled even when an incoming SAML LogoutRequest message is not accompanied by the session cookie for the active session

signing

one of

conditional, true, false, front, back


See Signing&Encryption. Controls outbound signing of XML messages and content subject to applicability to the protocol involved.

encryption


See Signing&Encryption. Controls outbound encryption of XML messages and content subject to applicability to the protocol involved.

  • No labels