Liberty ID-FF Bindings and Profiles Specification - Liberty Alliance

Liberty Alliance Project:Liberty ID-FF Bindings and Profiles SpecificationVersion: 1.2-errata-v2.016061607160816091610161116121613161416151616161716181619162016211622162316241625This URI identifier is really only meant for service provider consumption and as such is not needed in any providermetadata.3.4.2.2. SOAP/HTTP-Based ProfileThe SOAP/HTTP-based profile relies on using asynchronous SOAP over HTTP to communicate federation terminationnotification messages from the service provider to the identity provider. For a discussion of the interactions andprocessing steps, refer to 3.4.1.2. When reviewing that profile, interchange all references to service provider andidentity provider in the interaction diagram and processing steps.The following URI-based identifier MUST be used when referencing this specific profile:URI: http://projectliberty.org/profiles/fedterm-sp-soapThis URI identifier is really only meant for service provider consumption and as such is not needed in any providermetadata.3.5. Single Logout ProfilesThe single logout profiles synchronize session logout functionality across all sessions that were authenticated by aparticular identity provider. The single logout can be initiated at either the identity provider or the service provider.In either case, the identity provider will then communicate a logout request to each service provider with which ithas established a session for the Principal. The negotiation of which single logout profile the identity provider usesto communicate with each service provider is based upon the SingleLogoutProtocolProfile provider metadata elementdefined in [LibertyProtSchema].The available profiles are defined in Section 3.5.1 and Section 3.5.2, depending on whether the single logout is initiatedat the identity provider or service provider:1626• Single Logout Initiated at Identity Provider1627162816291630• HTTP-Based: Relies on using either HTTP 302 redirects or HTTP GET requests to communicate logoutrequests from an identity provider to the service providers.• SOAP/HTTP-Based: Relies on SOAP over HTTP messaging to communicate logout requests from an identityprovider to the service providers.1631• Single Logout Initiated at Service Provider16321633163416351636• HTTP-Redirect-Based: Relies on an HTTP 302 redirect to communicate a logout request with the identityprovider.• SOAP/HTTP-Based: Relies on SOAP over HTTP messaging to communicate a logout request from a serviceprovider to an identity provider.The single logout profiles make use of the following metadata elements, as defined in [LibertyMetadata]:16371638• SingleLogoutServiceURL — The URL at the service provider or identity provider to which single logoutrequests are sent. It is described in these profiles as "single logout service URL."Liberty Alliance Project46