Liberty ID-FF Bindings and Profiles Specification - Liberty Alliance

Liberty Alliance Project:Liberty ID-FF Bindings and Profiles SpecificationVersion: 1.2-errata-v2.018871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921In step 5, the identity provider’s single logout service responds and redirects the user agent back to service providerusing the return URL location obtained from the SingleLogoutServiceReturnURL metadata element. If the URLencoded message received in step 3 contains a parameter named RelayState, then the identityprovider MUST include a component containing the same RelayState parameter and its value in its responseto the service provider.The purpose of this redirect is to return the user agent to the service provider.The HTTP response MUST take the following form: 302 Location : https://?where:This element provides the host name, port number, and path components of the return URL location at the serviceprovider.= ...The component MUST contain a single logout response. The componentMUST contain the identical RelayState parameter and its value that was received in the URL-encoded logoutrequest message obtained in step 3. If no RelayState parameter was provided in the step 3 message, then a RelayStateparameter MUST NOT be specified in the .3.5.2.1.6. Step 6: Accessing the Service Provider Return URLIn step 6, the user agent accesses the service provider’s return URL location fulfilling the redirect request.3.5.2.1.7. Step 7: ConfirmationIn step 7, the user agent is sent an HTTP response that confirms the requested action of a single logout has beencompleted.3.5.2.2. SOAP/HTTP-Based ProfileThe SOAP/HTTP-based profile relies on using SOAP over HTTP messages to communicate a logout request tothe identity provider. The identity provider will then communicate a logout request to each service provider it hasestablished a session with for the Principal via the service provider’ preferred profile for logout requests from theidentity provider (see Section 3.5.1). See Figure 16.The following URI-based identifier MUST be used when referencing this specific profile:URI: http://projectliberty.org/profiles/slo-sp-soapThis URI identifier is intended for service provider consumption and is not needed in provider metadata.Liberty Alliance Project55