{"type":"doc","content":[{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" element is used to enable and configure support for Logout protocols and behavior within the SP. Logout in general can be enabled or disabled by adding or removing it. ","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" element automates the installation of the appropriate handlers based on the protocols selected for activation. ","type":"text"}]},{"type":"paragraph","content":[{"text":"The use of the ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" element results in a basic chain of initiator plugins installed at the recommended ","type":"text"},{"text":"\"/Logout\"","type":"text","marks":[{"type":"code"}]},{"text":" handler location. For advanced scenarios that require additional plugins or options, additional explicit <","type":"text"},{"text":"LogoutInitiator","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065334687"}}]},{"text":"> elements can be added to the end of the surrounding <","type":"text"},{"text":"Sessions","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065334342"}}]},{"text":"> element.","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"03441e7d-aee9-4bd6-a479-b62756d44e14"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"bf276a69-2467-4a68-a779-222893652341"}},{"type":"heading","attrs":{"level":3},"content":[{"text":"Attributes","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","width":1266.0,"localId":"a88badce-356c-41f3-a85c-74c86bb0d28b"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"Name","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[171.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[93.0]},"content":[{"type":"paragraph","content":[{"text":"Default","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[817.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"relayState ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[171.0]},"content":[{"type":"paragraph","content":[{"text":"string","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[93.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[817.0]},"content":[{"type":"paragraph","content":[{"text":"Overrides relayState setting from the ","type":"text"},{"text":"","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065334342"}}]},{"text":" element.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":4,"rowspan":1,"colwidth":[185.0,171.0,93.0,817.0]},"content":[{"type":"paragraph","content":[{"text":"The following attribute can be specified for the SAML2 protocols","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"Name","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[171.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[93.0]},"content":[{"type":"paragraph","content":[{"text":"Default","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[817.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"template","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[171.0]},"content":[{"type":"paragraph","content":[{"text":"local pathname","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[93.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[817.0]},"content":[{"type":"paragraph","content":[{"text":"An HTML template used during transmission of the message.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"outgoingBindings","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[171.0]},"content":[{"type":"paragraph","content":[{"text":"space delimited URIs","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[93.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[817.0]},"content":[{"type":"paragraph","content":[{"text":"List of SAML binding identifiers that determines the order of preferred bindings to use for the request. If this setting is used, failing to list a binding will prevent the use of an IdP that only supports the omitted binding.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"postArtifact","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[171.0]},"content":[{"type":"paragraph","content":[{"text":"boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[93.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[817.0]},"content":[{"type":"paragraph","content":[{"text":"If true, the SAML artifact binding is implemented using a form POST rather then a redirect.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"asynchronous","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[171.0]},"content":[{"type":"paragraph","content":[{"text":"boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[93.0]},"content":[{"type":"paragraph","content":[{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[817.0]},"content":[{"type":"paragraph","content":[{"text":"When true, the logout request will contain an ","type":"text"},{"text":"extension","type":"text","marks":[{"type":"link","attrs":{"href":"https://wiki.oasis-open.org/security/ASLO"}}]},{"text":" signaling that the SP doesn't need a response back. This is used to simplify the typical use case in which the user interface is meant to stay at the IdP after the logout completes.","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Element Content","type":"text"}]},{"type":"paragraph","content":[{"text":"The content of the element is a whitespace-delimited list of \"protocol\" identifiers. The following are built-in to the SP:","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"SAML2","type":"text"}]},{"type":"paragraph","content":[{"text":"SAML 2.0 Browser Single Logout profile (front- and back-channel)","type":"text"}]},{"type":"paragraph","content":[{"text":"For more complete information about the exact protocol behavior, see the ","type":"text"},{"text":"SingleLogoutService","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065334692"}}]},{"text":" topic.","type":"text"}]},{"type":"paragraph","content":[{"text":"See also ","type":"text"},{"text":"SAML2 Sessions Configurations","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065334916"}}]},{"text":" ","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Local","type":"text"}]},{"type":"paragraph","content":[{"text":"Local removal of a user's session with no IdP involvement","type":"text"}]},{"type":"paragraph","content":[{"text":"An additional protocol is supported if the relevent extension is loaded. See also the ","type":"text"},{"text":"Local LogoutInitiator","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065334803"}}]},{"text":" topic","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"ADFS","type":"text"}]},{"type":"paragraph","content":[{"text":"WS-Federation Passive Interoperability Profile (legacy ADFS)","type":"text"}]},{"type":"paragraph","content":[{"text":"For more complete information about the exact protocol behavior, see the ","type":"text"},{"text":"SingleLogoutService","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065334692"}}]},{"text":" opic.","type":"text"}]},{"type":"paragraph","content":[{"text":"The ADFS handler is only available if the ","type":"text"},{"text":"adfs.so","type":"text","marks":[{"type":"code"}]},{"text":" extension library is loaded by the SP.","type":"text"}]},{"type":"paragraph","content":[{"text":"Indicated by ","type":"text"},{"text":"type=\"ADFS\"","type":"text","marks":[{"type":"code"}]},{"text":", supports Microsoft ADFS \"signout\" requests. If the user's session was initiated with a protocol other than ADFS, then the handler ignores the request. Otherwise, the initiating entityID is used to check for metadata with an ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" role supporting ADFS and a compatible ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" endpoint. The absence of either causes a warning to be logged and the handler otherwise ignores the request.","type":"text"}]},{"type":"paragraph","content":[{"text":"A \"supporting\" IdP's role element has a ","type":"text"},{"text":"protocolSupportEnumeration","type":"text","marks":[{"type":"code"}]},{"text":" attribute containing the value ","type":"text"},{"text":"\"http://schemas.xmlsoap.org/ws/2003/07/secext\"","type":"text","marks":[{"type":"code"}]},{"text":", with an accompanying ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":"with a ","type":"text"},{"text":"Binding","type":"text","marks":[{"type":"code"}]},{"text":" of ","type":"text"},{"text":"\"http://schemas.xmlsoap.org/ws/2003/07/secext\"","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"If a \"return\" query string parameter is provided, it will be passed to the home realm STS in a \"wreply\" parameter.","type":"text"}]},{"type":"paragraph","content":[{"text":"Whether or not the logout request is successfully issued, the user's session will be removed if at all possible.","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Others","type":"text"}]},{"type":"paragraph","content":[{"text":"Other protocols can be \"integrated\" with the service-based configuration mechanism by supplying the relevant information via the <","type":"text"},{"text":"ProtocolProvider","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065335163"}}]},{"text":"> plugin interface.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Example","type":"text"}]},{"type":"paragraph","content":[{"text":"A basic example supporting SAML 2.0 and \"localized\" logout:","type":"text"}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"SAML2 Local","type":"text"}]},{"type":"paragraph"}],"version":1}