title: How does a SAML IdP communicate changes with the SP?
body: <p>I'm working to integrate SAML SSO into an older PHP application. I am using <a href="http://simplesamlphp.org" rel="nofollow noreferrer">simplesamlphp</a> to set up my service provider and for testing purposes, I have a OneLogin dev account set up with a "SAML Test Connector (IdP w/attr)" test application as my IdP. I can successfully sign in, and I can log the user out using single log out. What I'm currently lost with is how the IdP communicates changes such as forced sign out and removing access to the application. </p>
  
  <p>I had assumed that OneLogin would send a request to the URL I provide as the "Single Logout URL" once I forced a user to sign out or removed their privileges to the application along with enough data to identify the user. I would then expire that user's session in the service provider and everything would be good. But OneLogin isn't sending that request like I am expecting (it is only called after I initiate a single logout process on my end). The other option would seem to be me sending requests to OneLogin to validate the session frequently, but that seems inefficient. </p>
  
  <p>What is the proper method for acquiring session/privilege updates from SAML? </p>