Proposed erratum resolution for PE8

Title: Message

Hi, here is proposed 
text for PE8.

 

 

PE8: SLO and 
NameID termination

[SAMLBind]

Replace the last 
sentence in 2479-2480 (section 3.6.3) 
with:

"In general 
it SHOULD NOT invalidate any active session(s) of the 
principal for whom the relationship has been 
terminated. If the receiving provider is 
an identity provider, it SHOULD NOT invalidate any active session(s) of the 
principal established with other service 
providers. A requesting provider MAY send a 
<LogoutRequest> message prior to initiating a name 
identifier termination by sending a <ManageNameIDRequest> 
message if that is the requesting provider's intent (e.g., the name 
identifier termination is initiated via an administrator who wished to terminate 
all user activity). The 
requesting provider MUST NOT send 
a <LogoutRequest> message after the 
<ManageNameIDRequest> message is sent."

 

My intent here is that 
the MNI protocol should not imply SLO in any way. I.e., if the requester wishes 
an SLO, it should do so explicity using a <LogoutRequest> message prior to 
MNI.

Tom.

Thomas Wisniewski
Software Architect 
Phone: (201) 
891-0524 
Cell: (201) 248-3668 

  
EntrustÒ 
Securing Digital Identities
& Information