Liberty ID-FF Bindings and Profiles Specification - Liberty Alliance

Liberty Alliance Project:Liberty ID-FF Bindings and Profiles SpecificationVersion: 1.2-errata-v2.0185118521853185418551856authentication assertions during the Principal’s current session. If a current session exists for the Principal at theservice provider, it is RECOMMENDED that the service provider terminate that session prior to step 2.3.5.2.1.2. Step 2: Redirecting to the Single Logout Service at the Identity ProviderIn step 2, the service provider’s single logout service responds and redirects the user agent to the single logout serviceURL at the identity provider.The redirection MUST adhere to the following rules:185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886• The Location HTTP header MUST be set to the identity provider’s single logout service URL.• The identity provider’s single logout service URL MUST specify https as the URL scheme; if another scheme isspecified, the service provider MUST NOT redirect to the identity provider.• The Location HTTP header MUST include a component containing the protocol message as defined in [LibertyProtSchema] with formatting as specified in 3.1.2.The HTTP response MUST take the following form: 302 Location : https://?where:This element provides the host name, port number, and path components of the single logout service URL at theidentity provider.= ......The MUST contain a single logout request.3.5.2.1.3. Step 3: Accessing the Identity Provider Single Logout ServiceIn step 3, the user agent accesses the identity provider’s single logout service URL with the information attached to the URL fulfilling the redirect request.3.5.2.1.4. Step 4: Processing the RequestIn step 4, the identity provider MUST process the according to the rules defined in[LibertyProtSchema].Each service provider for which the identity provider has provided authentication assertions during the Principal’scurrent session MUST be notified via the service provider’s preferred profile for logout request from the identityprovider (see Section 3.5.1).The identity provider’s current session with the Principal MUST be terminated, and no more authentication assertionsfor the Principal are to be given to service providers.3.5.2.1.5. Step 5: Redirecting to the Service Provider Return URLLiberty Alliance Project54