SAML IdP如何与SP传达更改？

Question

I'm working to integrate SAML SSO into an older PHP application. I am using simplesamlphp to set up my service provider and for testing purposes, I have a OneLogin dev account set up with a "SAML Test Connector (IdP w/attr)" test application as my IdP. I can successfully sign in, and I can log the user out using single log out. What I'm currently lost with is how the IdP communicates changes such as forced sign out and removing access to the application.

I had assumed that OneLogin would send a request to the URL I provide as the "Single Logout URL" once I forced a user to sign out or removed their privileges to the application along with enough data to identify the user. I would then expire that user's session in the service provider and everything would be good. But OneLogin isn't sending that request like I am expecting (it is only called after I initiate a single logout process on my end). The other option would seem to be me sending requests to OneLogin to validate the session frequently, but that seems inefficient.

What is the proper method for acquiring session/privilege updates from SAML?

Answer 1

From what I read, you don't get updates, you ask IdP about them (request user login or logout, which will check user status): http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0-cd-02.html#5.3.Single%20Logout%20Profile|outline

I don't think simplesamlphp would act as kind of enforcer of policies, you login as a user, you get your cookie until it expires.

I know you can set up session cookie duration to reasonable value in config.php of simplesamlphp, try that.