Liberty ID-FF Bindings and Profiles Specification - Liberty Alliance

Liberty Alliance Project:Liberty ID-FF Bindings and Profiles SpecificationVersion: 1.2-errata-v2.018261827182818291830183118321833183418351836183718381839184018413.5.1.2.4. Step 4: Responding to the RequestIn step 4, the service provider MUST respond to the with a SOAP 200 OK message.3.5.1.2.5. Step 5: ConfirmationIn step 5, the user agent is sent an HTTP response that confirms the requested action of single logout has completed.3.5.2. Single Logout Initiated at Service ProviderThe profiles in Section 3.5.2.1 and Section 3.5.2.2 are specific to the Principal’ initiation of the single logout requestprocess at the service provider.3.5.2.1. HTTP-Based ProfileThe HTTP-based profile relies on using an HTTP 302 redirect to communicate a logout request with the identityprovider. The identity provider will then communicate a logout request to each service provider with which it hasestablished a session for the Principal using the service provider’ preferred profile for logout request from the identityprovider (see Section 3.5.1). See Figure 15.The following URI-based identifier MUST be used when referencing this specific profile:URI: http://projectliberty.org/profiles/slo-sp-httpThis URI identifier is intended for service provider consumption and is not needed in provider metadata.User AgentService ProviderIdentity Provider1. HTTP Request()2. 302; Location: ?()3. GET: ?5. 302; Location: ?()4. ProcessRequest6. GET: ?()7: 200 OK: ()18421843Figure 15. HTTP-redirect-based profile for single logout initiated at service provider1844184518461847184818491850Note:Step 4 may involve an iterative process by the identity provider to implement the preferred profile for logoutrequests for each service provider that has been issued authentication assertions during the Principal’s currentsession.3.5.2.1.1. Step 1: Accessing the Single Logout Service at the Service ProviderIn step 1, the user agent accesses the single logout service URL at the service provider indicating that session logoutis desired at the associated identity provider and all service providers for which this identity provider has providedLiberty Alliance Project53