The Difficulties of SAML Single Logout

Re:The Difficulties of SAML Single Logout by bob1029 on Wednesday March 17, 2021 @06:50AM (#26489190)

One of our customers brought this up with us briefly when discussing integration of our application into their infrastructure.

I had independently concluded that the complexity probably wasn't worth it, but I hadn't considered shorter sessions as a mitigating factor.

Looks like the sands of time are the best solution yet again. I can easily spin 15 minute sessions as a superior alternative to SLO when talking to a customer. Determinism is the biggest point and I can play that against security & compliance very easily in my industry.

[ Parent | on HN ]

Re:The Difficulties of SAML Single Logout by 35fbe7d3d5b9 on Wednesday March 17, 2021 @11:26AM (#26492535)

SLO is one of those things that could be good if everyone played nicely together.

If you end up having to implement it, hedge with sessions as short as your compliance needs dictate. Expire your own session at the very beginning of the dance before you lose control.

And do not, under any circumstances, let them talk you into front-channel SLO. They probably won't unless they're totally clueless. But if they do it's the surest way to end up blamed for someone else's problems. Otherwise you'll end up with a support ticket some day that says "I clicked log out on bob1029's app and got a Datadog error page, what?!". And I'll smile.

[ Parent | on HN ]

Re:The Difficulties of SAML Single Logout by bob1029 on Wednesday March 17, 2021 @12:44PM (#26493626)

Thanks for the heads-up on potential traps. I will make sure we keep a tight leash on this conversation...

[ Parent | on HN ]