{"type":"doc","content":[{"type":"paragraph","content":[{"text":"File(s):","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"conf/idp.properties, views/logout.vm, views/logout-complete.vm, views/logout-propagate.vm","type":"text","marks":[{"type":"em"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"SLO is a best-effort attempt to end relying party sessions without clearing the browser's cookie and storage state. Most browsers do ","type":"text"},{"text":"not","type":"text","marks":[{"type":"strong"}]},{"text":" clear this state when closed. It is deeply imperfect, minimally supported, and should not be viewed as a security feature or treated as reliable. Trivial and recommended browser settings can render it totally non-functional. It has no future. You should understand all of that before even considering it.","type":"text"}]}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"dc0f42c7-c6d1-4f40-a2a4-e06e2a6f132f"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"e4356197-f9f9-4cb1-9c7c-f4263f918eb8"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Proprietary/Simple Logout","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"When an HTTP GET request is made to the ","type":"text"},{"text":"/profile/Logout","type":"text","marks":[{"type":"em"}]},{"text":" endpoint with a valid IdP session cookie, the corresponding IdP session is ended and the ","type":"text"},{"text":"logout.vm","type":"text","marks":[{"type":"em"}]},{"text":" view is rendered that informs the user of the following:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The IdP session is ended.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Lists all services accessed during the IdP session, if tracked, and offers to end those sessions by propagating a logout message to each one.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"If the user chooses SLO, the ","type":"text"},{"text":"logout-propagate.vm","type":"text","marks":[{"type":"em"}]},{"text":" view is rendered and the browser mediates (i.e. front-channel) a series of logout messages coordinated via iframes, javascript, and in some cases HTML5 storage. The result is a best-effort attempt to explicitly end each relying party session by sending a protocol-specific message to each service endpoint. In the IdP configuration, the SLO messaging process is called ","type":"text"},{"text":"propagation","type":"text","marks":[{"type":"em"}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"If configured to do so, the IdP attempts to display prominent status information on the result of each attempt to end a relying party session; a red X for failure or a green checkbox for success. This is typically quite limited in accuracy, and many false positives or negatives should be expected. We do not in general recommend displaying this to users, but have not (yet) deprecated support for displaying it.","type":"text"}]},{"type":"paragraph","content":[{"text":"If the user chooses to end without SLO, ","type":"text"},{"text":"logout-complete.vm","type":"text","marks":[{"type":"em"}]},{"text":" is rendered and a message is displayed indicating that some relying party sessions may still be active.","type":"text"}]},{"type":"paragraph","content":[{"text":"By default, the IdP session is terminated regardless of the user's choice. In other words, the question asked is \"propagate or not?\" rather than \"logout or not?\". The ","type":"text"},{"text":"idp.logout.promptUser","type":"text","marks":[{"type":"strong"}]},{"text":" property can be set to a ","type":"text"},{"text":"Predicate","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.Predicate"}}]},{"text":" bean that allows the user to make a cancel decision.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Configuration","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"idp.session.trackSPSessions","type":"text","marks":[{"type":"strong"}]},{"text":" property must be enabled to support the SLO propagation feature (it is explicitly enabled by default for new installs but defaults to false).","type":"text"}]},{"type":"paragraph","content":[{"text":"If you want the displayed information about services to be customized by the use of SAML metadata (for things like service names and logos), you should also set the ","type":"text"},{"text":"idp.logout.elaboration","type":"text","marks":[{"type":"strong"}]},{"text":" property to true.","type":"text"}]},{"type":"paragraph","content":[{"text":"In order for CAS protocol services to participate in SLO, the ","type":"text"},{"text":"singleLogoutParticipant","type":"text","marks":[{"type":"em"}]},{"text":" attribute must be set to true in the service definitions that identify the service:","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"CAS Registered Service Example","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"","type":"text"}]},{"type":"paragraph","content":[{"text":"In order for SAML services to participate in SLO, the SAML metadata supplied for them must contain appropriate ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" endpoints. If there are multiple endpoints that vary by location, the standard does not stipulate how an IdP is to determine which endpoint to use. The IdP will attempt to select the endpoint based on the best match possible between the logout endpoint and the original endpoint used to deliver the authentication response.","type":"text"}]},{"type":"paragraph","content":[{"text":"In addition, SPs vary in how they handle security, and SLO is in general vastly less interoeprable than SSO in SAML, so you should not expect uniform results. Shibboleth itself assumes that all logout messages are signed, and if you need to interoperate with SPs that don't sign their logout responses, you will need to set the ","type":"text"},{"text":"idp.logout.authenticated","type":"text","marks":[{"type":"strong"}]},{"text":" to false.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"UI Considerations","type":"text"}]},{"type":"paragraph","content":[{"text":"The look and feel of the logout process can be changed through modification of the view templates, message properties, etc.","type":"text"}]},{"type":"paragraph","content":[{"text":"Some deployers may choose to make SLO mandatory, which would require modifying the ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" content of ","type":"text"},{"text":"logout.vm","type":"text","marks":[{"type":"em"}]},{"text":" and/or to override the default calculation of the conditional that wraps the $promptForIdP and $promptForSP variables in the template.","type":"text"}]},{"type":"paragraph","content":[{"text":"The UI in this version has a general model that presents the applicable subset of three options to the user:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Logout of the IdP only","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Logout of the IdP and SPs where possible","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Canceling the logout","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"The latter option can be enabled by setting the ","type":"text"},{"text":"idp.logout.promptUser","type":"text","marks":[{"type":"strong"}]},{"text":" property to the name of a ","type":"text"},{"text":"Predicate","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.Predicate"}}]},{"text":" bean that evaluates to true under the desired conditions.","type":"text"}]},{"type":"paragraph","content":[{"text":"The SLO machinery is a fairly complex interaction between embedded iframes and javascript that drives and processes logout messages. That logic, due to its complex and fragile nature, is confined to a system view file.","type":"text"}]},{"type":"paragraph","content":[{"text":"The UI is also, to our understanding, not accessible and is apparently impossible to make accessible. Whether true or not, it definitely is not by default and no fixes for this have been provided. It is believed that hiding the propagation status reporting is accessible, and the ","type":"text"},{"text":"idp.logout.propagationHidden","type":"text","marks":[{"type":"strong"}]},{"text":" property exists to hide this reporting from the user both for accessibility and because of the large number of false positives and negatives that are typically encountered.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Preserving Parameters","type":"text"}]},{"type":"paragraph","content":[{"text":"The design of the logout feature does ","type":"text"},{"text":"not","type":"text","marks":[{"type":"underline"}]},{"text":" support returning control of the user agent to any other system via a \"return\" parameter or similar mechanism. While this remains officially unsupported, the ","type":"text"},{"text":"idp.logout.preserveQuery","type":"text","marks":[{"type":"strong"}]},{"text":" property can be set to true to cause any parameters on the original request to be preserved and made accessible via a ","type":"text"},{"text":"ScratchContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.messaging.context.ScratchContext"}}]},{"text":" object underneath the ","type":"text"},{"text":"ProfileRequestContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.profile.context.ProfileRequestContext"}}]},{"text":".","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"There are some issues to be cautious of with this approach:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Note that any kind of redirection strategy that is not constrained in some way will turn the IdP into an Open Redirector. The IdP does not provide any mitigation for that, which is why this is officially unsupported and not enabled by default.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Additionally, be aware that if you use the ","type":"text"},{"text":"ScratchContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.messaging.context.ScratchContext"}}]},{"text":" class for your own customizations, you should take care to avoid conflicts and probably avoid using the context directly under the ","type":"text"},{"text":"ProfileRequestContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.profile.context.ProfileRequestContext"}}]},{"text":" to avoid the risk of a query parameter overriding your own internal state being handled by the context.","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Browser Support","type":"text"}]},{"type":"paragraph","content":[{"text":"The SLO feature requires a fair bit of mature Javascript support, but any browser that supports HTML5 LocalStorage should work (this use of LocalStorage is independent of the choice of storage service, and it applies even when server-side storage is used). While the SLO implementation is based on modern Web standards, browser features vary so greatly that it's hard to identify minimum browser requirements.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Troubleshooting","type":"text"}]},{"type":"paragraph","content":[{"text":"Because the logout propagation feature - as far as the front-channel support is concerned - uses Javascript, all communication with the SPs can be traced in the Web browser. To this end, both the SAML tracer (Firefox Plugin) and the Javascript console in most browsers' developer tools can be helpful in troubleshooting. Common errors can be:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The SP’s web server has set the X-Frame-Options to “sameorigin”, or similar CSP features, which will generally cause the SLO exchange to fail.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"SAML Logout","type":"text"}]},{"type":"paragraph","content":[{"text":"SAML Logout is a more complex protocol than the simple variant described above, but the implementation is shared across the two approaches. There are really two \"halves\" to this:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Responding to requests from an SP","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Propagating logout to an SP","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"This section is about the first case. The propagation step is covered in the previous section and is the same, regardless of how the logout is initiated.","type":"text"}]},{"type":"paragraph","content":[{"text":"SPs can request a logout using either front- or back-channel SAML bindings (typically HTTP-Redirect on the front, SOAP on the back). The IdP supports reception of either type of request, but use of SOAP obviously requires server-side session state. Propagation to SPs via SOAP when possible is supported more or less automatically, and happens either as part of back-channel processing or as a result of the usual front-channel iframe-based propagation.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Basic Configuration","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"idp.session.secondaryServiceIndex","type":"text","marks":[{"type":"strong"}]},{"text":" property must be enabled to support SAML logout requests (it is explicitly enabled by default for new installs, but defaults to false).","type":"text"}]},{"type":"paragraph","content":[{"text":"Another consideration with SAML logout has to do with the length of time the system will \"remember\" the SP's session, in order to prevent the session cache from growing endlessly. This can't be done precisely because the IdP doesn't actually know how long the SP's own session might last. The ","type":"text"},{"text":"idp.session.defaultSPlifetime","type":"text","marks":[{"type":"strong"}]},{"text":" and ","type":"text"},{"text":"idp.session.slop","type":"text","marks":[{"type":"strong"}]},{"text":" properties control how long the IdP will \"remember\" an SP's session. Once elapsed, it's likely that a request for logout will fail from any SP that has expired from the cache.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Advanced Options","type":"text"}]},{"type":"paragraph","content":[{"text":"Even SPs that support requesting logout may not support receiving them, and many SPs may not care about responses to their requests. In such cases, it is advantageous to simple remove the ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" endpoints from their metadata. Unfortunately this fails due to the IdP's requirement to try and issue a response in most cases, and results in an error.","type":"text"}]},{"type":"paragraph","content":[{"text":"A property named ","type":"text"},{"text":"idp.logout.assumeAsync","type":"text","marks":[{"type":"strong"}]},{"text":" (if true) allows requests to be treated as though they carried the ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" extension element, which tells the IdP that no response is needed. This allows the removal of endpoints from SP metadata to be an effective means of mitigating such problems with SPs by allowing inbound logout to the IdP while preventing outbound logout.","type":"text"}]},{"type":"paragraph","content":[{"text":"A bean is also exposed to allow message level encryption of ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" values to be suppressed based on ","type":"text"},{"text":"Format","type":"text","marks":[{"type":"code"}]},{"text":". This is primarily suported to improve efficiency, given that many SPs rely on the ","type":"text"},{"text":"urn:oasis:names:tc:SAML:2.0:nameid-format:transient","type":"text","marks":[{"type":"code"}]},{"text":" format, which isn't all that important to encrypt. A typical bean definition in ","type":"text"},{"text":"conf/global.xml","type":"text","marks":[{"type":"em"}]},{"text":":","type":"text"}]},{"type":"codeBlock","content":[{"text":" \n \n \n ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[115.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[270.0]},"content":[{"type":"paragraph","content":[{"text":"If the bean returns true, the user is given the option to actually cancel the IdP logout outright and prevent removal of the session","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[178.0]},"content":[{"type":"paragraph","content":[{"text":"idp.artifact.enabled","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[115.0]},"content":[{"type":"paragraph","content":[{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[270.0]},"content":[{"type":"paragraph","content":[{"text":"Controls use of HTTP-Artifact binding for outbound logout messages","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[178.0]},"content":[{"type":"paragraph","content":[{"text":"idp.logout.preserveQuery","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[115.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[270.0]},"content":[{"type":"paragraph","content":[{"text":"Processes arbitrary query parameters to the Simple Logout endpoint and stashes them in a ","type":"text"},{"text":"ScratchContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.messaging.context.ScratchContext"}}]},{"text":" for use by subsequent view logic","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[178.0]},"content":[{"type":"paragraph","content":[{"text":"idp.logout.assumeAsync","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[115.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[270.0]},"content":[{"type":"paragraph","content":[{"text":"When true, allows inbound SAML LogoutRequests to be processed even if the SP lacks metadata containing response endpoints","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[178.0]},"content":[{"type":"paragraph","content":[{"text":"idp.logout.propagationHidden","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[115.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[270.0]},"content":[{"type":"paragraph","content":[{"text":"Applies the \"display:none\" style to the list of SPs and logout status reporting images so that logout status is not visibly reported to the user","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[178.0]},"content":[{"type":"paragraph","content":[{"text":"idp.soap.httpClient","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"Bean ID of ","type":"text"},{"text":"HttpClient","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP5/pages/3199510442"}}]},{"text":" to use for SOAP-based logout","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[115.0]},"content":[{"type":"paragraph","content":[{"text":"SOAPClient.HttpClient","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[270.0]},"content":[{"type":"paragraph","content":[{"text":"Allows the ","type":"text"},{"text":"HttpClient","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP5/pages/3199510442"}}]},{"text":" used for SOAP communication to be overriden (applies to SAML logout via SOAP)","type":"text"}]}]}]}]}]},{"type":"expand","attrs":{"title":"Beans"},"content":[{"type":"paragraph","content":[{"text":"The following may be defined in ","type":"text"},{"text":"conf/global.xml","type":"text","marks":[{"type":"em"}]},{"text":" if needed.","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","localId":"5c26ad08-dce1-4f6f-b092-47fef78596c7"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"Name","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[71.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[243.0]},"content":[{"type":"paragraph","content":[{"text":"Default","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[232.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.PlaintextNameIDFormats","type":"text"}]},{"type":"paragraph","content":[{"text":" ","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[71.0]},"content":[{"type":"paragraph","content":[{"text":"Set","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.Set"}}]},{"text":"<","type":"text"},{"text":"String","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.lang.String"}}]},{"text":">","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[243.0]},"content":[{"type":"paragraph","content":[{"text":"urn:oasis:names:tc:SAML:2.0:nameid-format:entity","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[232.0]},"content":[{"type":"paragraph","content":[{"text":"Set of ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" Formats which need not be encrypted in messages, notwithstanding other settings","type":"text"}]}]}]}]}]},{"type":"paragraph"}],"version":1}