title: PingFederate: SP SLO vs. IDP SLO - Does it really matter?
body: <p>The <a href="http://documentation.pingidentity.com/display/PF/Specifying+SLO+Service+URLs+%28SAML+2.0%29" rel="nofollow noreferrer">PingFederate documentation</a> notes that you may configure <em>either</em> SP or IDP single-log-out (a.k.a. SLO).</p>
  
  <p>A user initiates SLO when that user requests a "Start-SLO" endpoint from their browser (i.e. either <code>http://&lt;PingFederate Base URL&gt;/sp/startSSO.ping</code> or <code>http://&lt;PingFederate Base URL&gt;/idp/startSSO.ping</code>).</p>
  
  <p>My Questions:</p>
  
  <ul>
  <li>Isn't this just a distinction <em>in name only</em>?  </li>
  <li>At the end of the day, aren't we just targeting an endpoint anyway?</li>
  <li>Does this choice have any material impact on the SLO process?</li>
  </ul>
  
  <hr>
  
  <p>@Scott T. had the following to say <a href="https://stackoverflow.com/q/8236928/109941">here</a>:</p>
  
  <blockquote>
    <p>If users start the SLO process at the IdP, then yes - users will be
    redirected back to /idp/SLO.saml2 as the last step. In fact, each SP
    that you redirect to for logout, will redirect back to the IdP to
    logout of the next SP. <strong>If you start the SLO process from an SP, then
    the last place users will end up is at that SP's SLO endpoint.</strong></p>
  </blockquote>
  
  <p>Indeed, it would be nice if PingFederate redirected to the SP that initated the SLO as the last step, but this hasn't been my experience.</p>
  
  <p>Perhaps I should also ask:</p>
  
  <ul>
  <li>How do you specify the SP that initated the SLO?</li>
  </ul>
  
  <hr>
  
  <p><strong>EDIT:</strong> Per @Scott T.'s answer <a href="https://stackoverflow.com/a/8276361/109941">here</a>:</p>
  
  <blockquote>
    <p>I'm assuming here you have PingFederate as an IdP and SP (potentially
    2 separate installs).</p>
  </blockquote>
  
  <p>As I understand the definitions of IdP and SP:</p>
  
  <ul>
  <li>PingFederate is <strong><em>neither</em></strong> my IdP <strong>nor</strong> one of my SPs.**</li>
  <li>For my configuration, PingFederate merely facilitates the open token transfer <em>between</em> my IdP and my SP.</li>
  <li>Until very recently, I was of the belief that this was a completely valid configuration.</li>
  <li>But now it seems like this configuration doesn't facilitate SLO; or at least as nicely as it would if PingFederate was acting as my IdP.
  
  <ul>
  <li>Is this correct?</li>
  </ul></li>
  </ul>
  
  <p>**When I say this, I mean to say that I have:  </p>
  
  <ul>
  <li>A standalone web application which authenticates users, and has a backing store (i.e. a database) that includes user names and passwords - <strong>This acts as my IdP.</strong></li>
  <li>Multiple standalone web applications which are linked to my IdP which display data and provide functionality to my users - <strong>These act as my SPs.</strong></li>
  </ul>