Re:The Difficulties of SAML Single Logout
by 35fbe7d3d5b9 on Wednesday March 17, 2021 @11:26AM
(#26492535)
SLO is one of those things that could be good if everyone played nicely together.
If you end up having to implement it, hedge with sessions as short as your compliance needs dictate. Expire your own session at the very beginning of the dance before you lose control.
And do not, under any circumstances, let them talk you into front-channel SLO. They probably won't unless they're totally clueless. But if they do it's the surest way to end up blamed for someone else's problems. Otherwise you'll end up with a support ticket some day that says "I clicked log out on bob1029's app and got a Datadog error page, what?!". And I'll smile.
If you end up having to implement it, hedge with sessions as short as your compliance needs dictate. Expire your own session at the very beginning of the dance before you lose control.
And do not, under any circumstances, let them talk you into front-channel SLO. They probably won't unless they're totally clueless. But if they do it's the surest way to end up blamed for someone else's problems. Otherwise you'll end up with a support ticket some day that says "I clicked log out on bob1029's app and got a Datadog error page, what?!". And I'll smile.