4 ms·

I’m not sure if CAS is even partially SAML compliant or even related to it at all, but the way CAS handled it was that for every service ticket issued, the auth

I’m not sure if CAS is even partially SAML compliant or even related to it at all, but the way CAS handled it was that for every service ticket issued, the authentication service was supposed to ping a URL destroying a service ticket. It didn’t have very good fallback (eg if it couldn’t successfully reach the service ticket destructor endpoint, it wouldn’t attempt to retry). Perhaps the safest way is for apps is to verify periodically if a SAML session is still valid, if there’s a mechanism to do so.

hunter2_ 6y ago
> for apps is to verify periodically if a SAML session is still valid, if there’s a mechanism to do so. In general, that seems equivalent to the SP having a short session and the IdP having a long session. Suppose it's 1 hour and 8 hours. At 1h0m1s the next request to the SP causes a redirect to the IdP, and if the IdP hasn't heard about a sign out request, it just redirects back to the SP with a valid assertion that gives you another hour on the SP. No prompt to re-auth until the 8 hour mark.