Liberty ID-FF Bindings and Profiles Specification - Liberty Alliance

Liberty Alliance Project:Liberty ID-FF Bindings and Profiles SpecificationVersion: 1.2-errata-v2.01667166816691670167116721673167416751676167716781679[RFC2616] indicates a client should detect infinite redirection loops because such loops generate networktraffic for each redirection. This requirement was introduced because previous versions of the specificationrecommended a maximum of five redirections. Content developers should be aware that some clients mightimplement such a fixed limitation.3.5.1.1.1.1. Step 1: Accessing the Single Logout Service at the Identity ProviderIn step 1, the user agent accesses the single logout service URL at the identity provider indicating that all serviceproviders for which this identity provider has provided authentication assertions during the Principal’s current sessionmust be notified of session termination.3.5.1.1.1.2. Step 2: Redirecting to the Single Logout Service at the Service ProviderIn step 2, the identity provider’s single logout service responds and redirects the user agent to the single logout serviceURL at each service provider for which the identity provider has provided an authentication assertion during thePrincipal’s current session with the identity provider.The redirections MUST adhere to the following rules:168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703• The Location HTTP header MUST be set to the service provider’s single logout service URL.• The service provider’s single logout service URL MUST specify https as the URL scheme; if another scheme isspecified, the identity provider MUST NOT redirect to the service provider.• The Location HTTP header MUST include a component containing the protocol message as defined in [LibertyProtSchema] with formatting as specified in 3.1.2.The HTTP response MUST take the following form: 302 Location : https://?where:This element provides the host name, port number, and path components of the single logout service URL at theservice provider.= ......The MUST contain a single logout request.3.5.1.1.1.3. Step 3: Accessing the Service Provider Single Logout ServiceIn step 3, the user agent accesses the service provider’s single logout service URL with the information attached to the URL fulfilling the redirect request.3.5.1.1.1.4. Step 4: Processing the RequestIn step 4, the service provider MUST process the according to the rules defined in[LibertyProtSchema].Liberty Alliance Project48