SAML2LogoutHandler.java getParticipant

[alohci]

I've nearly got picketLink working the way I want, but I'm getting a problem during the global logout between the SAMLRequest and SAMLResponse idp messages. The url that is submitted to appears to be determined by the getParticipant method in SAML2LogoutHandler.java.

The comment in that says "Get a participant who is not equal to the original issuer of the logout request". What is the purpose of this? Why is the original issuer not appropriate in this circumstance?

[anil.saldhana]

Assume at the IDP, the session participants are (P1, P2, P3, P4).  Now P3 issues a GLO. The IDP needs to log out P1, P2 and P4 before logging out P3 and sending a log out response with success.

[anil.saldhana]

GLO is a complicated process. The simpler it is the better.  Another requirement is to keep it homogenous.