Liberty ID-FF Bindings and Profiles Specification - Liberty Alliance

Liberty Alliance Project:Liberty ID-FF Bindings and Profiles SpecificationVersion: 1.2-errata-v2.01797179817991800180118021803180418053.5.1.2. SOAP/HTTP-Based ProfileThe SOAP/HTTP-based profile uses SOAP over HTTP messaging to communicate a logout request to each serviceprovider for which the identity provider has provided authentication assertions during the Principal’s current session ifthe service provider indicated a preference to receive logout request via the SOAP/HTTP-based profile. See Figure 14.The following URI-based identifier MUST be used when referencing this specific profile:URI: http://projectliberty.org/profiles/slo-idp-soapThis URI identifier MUST be specified in the service provider metadata element SingleLogoutProtocolProfile whenthe service provider intends to indicate to the identity provider a preference for receiving logout requests via SOAPover HTTP.User AgentService ProviderIdentity Provider1. HTTP Request()2. SOAP POST: ()3. ProcessRequest4: SOAP 200 OK ()5: 200 OK: ()18061807Figure 14. SOAP/HTTP-based profile for single logout initiated at identity provider180818091810181118121813181418151816181718181819182018211822182318241825Note:Steps 2 through 4 may be an iterative process for each service provider that has been issued authenticationassertions during the Principal’s current session and has indicated a preference to receive logout requests viathe SOAP/HTTP message profile.3.5.1.2.1. Step 1: Accessing the Single Logout ServiceIn step 1, the user agent accesses the single logout service URL at the identity provider via an HTTP request.3.5.1.2.2. Step 2: Logout RequestIn step 2, the identity provider sends a SOAP over HTTP request to the SOAP endpoint of each service providerfor which it provided authentication assertions during the Principal’s current session. The SOAP message MUSTcontain exactly one element in the SOAP body and adhere to the construction rules definedin [LibertyProtSchema].If a SOAP fault occurs, the identity provider SHOULD employ best efforts to resolve the fault condition and resendthe single logout request to the service provider.3.5.1.2.3. Step 3: Processing the Logout RequestIn step 3, the service provider MUST process the according to the rules defined in[LibertyProtSchema].The service provider MUST invalidate the session for the Principal specified by the name identifier provided by theidentity provider in the .Liberty Alliance Project52