ProtocolSoup

IdP-Initiated Single Logout

The identity provider, acting as session authority, ends a principal's session and sends a signed LogoutRequest to each session participant (saml-profiles §4.4.2: an identity provider "can initiate this profile at step 2 and issue a <LogoutRequest> to all session participants, also skipping step 5"). This lab's IdP has one session participant, the SP, and uses the front-channel HTTP-Redirect or HTTP-POST binding through the user agent.

Try in Looking Glass
XML-BasedFederated Logout

Sequence Diagram

Click any step for details

IdPSP1IdP Ends Its Session2LogoutRequest to the SP3SP Ends Its Sessions4LogoutResponse to the IdP
Request
Response
Redirect
Internal

Step-by-Step Breakdown

1
IdP Ends Its Session
Identity Provider → Identity Provider
2
LogoutRequest to the SP
Identity Provider → Service Provider
3
SP Ends Its Sessions
Service Provider → Service Provider
4
LogoutResponse to the IdP
Service Provider → Identity Provider

Token Inspector

Specs for this flow

Sections of the protocol that normatively define this flow, plus the security considerations that apply to it.

Core specs

· The specifications that define this protocol.
BackLooking Glass