具有SAML 2.0的SLO（SP启动的SLO或IDP启动的SLO），最好在服务提供商中使用

Question

We created a application (SP), which have a option to login via SSO (Single Sign On) using third party application (any IdP). We used SAML 2.0 complaint for SSO(Single Sign On).

Question :

1. Which one is good to have in my application (SP initiated SLO or IDP initiated SLO)?

2. How many application using SP initiated slo and IDP initiated slo? (1 or 2 application(SP) name for each which are integrated with third party app)

3. How about creating both and keeping SLO is optional to IDP?

Can anyone help me

Answer 1

There is no requirement to provide SLO. Many large service providers do not (Google Apps and Salesforce, for example).

If you're going to provide for it, it's my opinion that you should support both, but not require it of the SP (make it an option within your SP). All enterprise implementations (PingFederate, OAM, Siteminder, etc.) that I am aware of support both, but do not require either, on both SP and IdP sides.