{
  "phase": "8",
  "mode": "dry_run",
  "target": "hub_and_idp",
  "status": "manual_approval_required",
  "operation": "enable_saml_logout_and_adapter_session_tracking",
  "name": "lab-pf-saml-logout-readiness-no-mfa",
  "admin_api_bases": {
    "hub": "https://hub-adm.sabathe.eu/pf-admin-api/v1",
    "idp": "https://idp-adm.sabathe.eu/pf-admin-api/v1"
  },
  "applications": [
    {
      "id": "saml-a",
      "display_name": "SAML Inspector A",
      "protocol": "SAML",
      "mode": "saml-sp",
      "base_url": "https://saml-a.sabathe.eu",
      "enabled": true
    },
    {
      "id": "saml-b",
      "display_name": "SAML Inspector B",
      "protocol": "SAML",
      "mode": "saml-sp",
      "base_url": "https://saml-b.sabathe.eu",
      "enabled": true
    }
  ],
  "desired_state": {
    "hub_saml_app_connections": [
      {
        "connection_id": "labsamlasp",
        "enabled_profiles": [
          "SP_INITIATED_SSO",
          "IDP_INITIATED_SSO",
          "IDP_INITIATED_SLO",
          "SP_INITIATED_SLO"
        ],
        "slo_service_endpoints": [
          {
            "binding": "REDIRECT",
            "url": "https://saml-a.sabathe.eu/saml/slo"
          },
          {
            "binding": "POST",
            "url": "https://saml-a.sabathe.eu/saml/slo"
          }
        ]
      },
      {
        "connection_id": "labsamlbsp",
        "enabled_profiles": [
          "SP_INITIATED_SSO",
          "IDP_INITIATED_SSO",
          "IDP_INITIATED_SLO",
          "SP_INITIATED_SLO"
        ],
        "slo_service_endpoints": [
          {
            "binding": "REDIRECT",
            "url": "https://saml-b.sabathe.eu/saml/slo"
          },
          {
            "binding": "POST",
            "url": "https://saml-b.sabathe.eu/saml/slo"
          }
        ]
      }
    ],
    "hub_to_idp_connection": {
      "connection_id": "labidpconnidpnomfa",
      "enabled_profiles": [
        "SP_INITIATED_SSO",
        "IDP_INITIATED_SSO",
        "IDP_INITIATED_SLO",
        "SP_INITIATED_SLO"
      ],
      "idp_slo_endpoint": "https://idp.sabathe.eu/idp/SLO.saml2"
    },
    "idp_to_hub_connection": {
      "connection_id": "labspconnhubnomfa",
      "enabled_profiles": [
        "SP_INITIATED_SSO",
        "IDP_INITIATED_SSO",
        "IDP_INITIATED_SLO",
        "SP_INITIATED_SLO"
      ],
      "hub_slo_endpoint": "https://hub.sabathe.eu/sp/SLO.saml2"
    },
    "idp_session_settings": {
      "endpoint": "session/settings",
      "trackAdapterSessionsForLogout": true,
      "revokeUserSessionOnLogout": true,
      "scope": "global PingFederate setting; use only after snapshot/diff"
    },
    "html_form_adapter": {
      "id": "labhtmlform",
      "session_state": "Per Adapter",
      "session_policy": "IdP HTML Form adapter keeps its own adapter-scoped session; no Hub session settings are changed."
    }
  },
  "checks_before_write": [
    "Snapshot Hub idp/spConnections for saml-a and saml-b",
    "Snapshot Hub sp/idpConnections/labidpconnidpnomfa",
    "Snapshot IdP idp/spConnections/labspconnhubnomfa",
    "Snapshot IdP idp/adapters/labhtmlform and session/settings",
    "Diff enabledProfiles and sloServiceEndpoints before PUT",
    "Confirm global IdP session tracking impact with Luc",
    "Apply one object at a time and verify SAML login then logout from Chrome"
  ]
}