NIIF SLO plugin for IdP 2.4.x

[Manuel Haim]

Hi,

recently, we had a meeting of members of the German DFN-AAI federation
on the topic of "Single Logout" (SLO). After comparing several
Shibboleth logout solutions in use, we quickly understood that the NIIF
SLO solution [1] was the most complete implementation available, and we
decided to give it a try.

As a result of the discussion, we just rewrote the NIIF SLO code [2] as
a true IdP plugin (which can be installed along a default Shibboleth IdP
2.4.x), so there is no more need for the outdated 2.3.8 NIIF branch of
the Shibboleth IdP.

Feel free to download and try the plugin (readme included):
http://www.staff.uni-marburg.de/~haimm/unimr-niif-slo.shib2.2014_08_29.tar.gz

Installation is performed by just adding some files to the IdP setup
directory and adding some lines to the handler.xml, relying-party.xml,
idp-metadata.xml and web.xml files.

Kind regards,
Manuel


[1] Single Logout in Shibboleth IdP (NIIF Institute, Hungary)
https://wiki.aai.niif.hu/index.php/Single_Logout_in_Shibboleth_IdP

[2] AAI Software provided by NIIF Institute
http://software.niif.hu/

[Cantor, Scott]

Post by Manuel Haim
As a result of the discussion, we just rewrote the NIIF SLO code [2] as
a true IdP plugin (which can be installed along a default Shibboleth IdP
2.4.x), so there is no more need for the outdated 2.3.8 NIIF branch of
the Shibboleth IdP.

You'll still run into fundamental limitations in the V2 session cache that
aren't really fixable.

I'm about to park the remaining work that's left to do to finish SLO in
V3, which is not going to be part of the initial release, but if you're
interested in helping to complete it for a follow on, let me know or post
on the dev list. If not, I expect it will remain parked for a while
(again).

Of course, the work left to do in V3 has absolutely nothing whatsoever to
do with what you'be done here, there won't be any significant reuse.

-- Scott

[Tom Scavo]

Post by Cantor, Scott
Of course, the work left to do in V3 has absolutely nothing whatsoever to
do with what you'be done here, there won't be any significant reuse.

But can/should the work that Manuel and team have done be submitted as
a V2 contribution in the wiki?

Tom

[Cantor, Scott]

Post by Tom Scavo

Post by Cantor, Scott
Of course, the work left to do in V3 has absolutely nothing whatsoever to
do with what you'be done here, there won't be any significant reuse.

But can/should the work that Manuel and team have done be submitted as
a V2 contribution in the wiki?

Of course, if by submitted you mean "added by whoever". It's just a list
of stuff wherever it may be.

-- Scott

[Tom Scavo]

Post by Cantor, Scott

Post by Tom Scavo
But can/should the work that Manuel and team have done be submitted as
a V2 contribution in the wiki?

Of course, if by submitted you mean "added by whoever". It's just a list
of stuff wherever it may be.

I'll leave this for Manuel to do (if desired), I was just asking the
obvious question.

Tom

[Manuel Haim]

Post by Cantor, Scott
You'll still run into fundamental limitations in the V2 session cache that
aren't really fixable.

Well, I know it won't be perfect.

However, I've added a wiki page:
https://wiki.shibboleth.net/confluence/display/SHIB2/NIIF+SLO+plugin

I still hope I will find the time to have a look at IdP 3 some day... ;)

-Manuel