RPs should be able to decide how (or if) they accept single logout requests

CATS 2.0 made it mandatory for all relying parties (RPs) to accept back-channel (i.e. SOAP) logout requests from the credential service providers (CSPs). This aligned with requirement [eGOV-093](https://kantarainitiative.github.io/SAMLprofiles/eGovImplProfile.html#_single_logout "Link to eGov 2.0") of the Kantara eGov 2.0 profile.

Kantara has now deprecated eGov 2.0 profile in favour of the new [InterOp](https://kantarainitiative.github.io/SAMLprofiles/egov-profile-diff.html) profile where this requirement has been dropped. Use of the SOAP binding for single logout is optional in Interop. This would seem to indicate that other SAML federations have had the same difficulties making the transition from front-channel to back-channel logout propagation that the Government of Canada Credential Federation (GCCF) has.

I propose that the CATS profile continue to recommend that RPs support back-channel logout propagation since it provides superior reliability and a better user experience compared to the use of front-channel (HTTP-Redirect) bindings, but it should no longer be mandatory.

I further propose that those RPs that provide services that are not normally accessed from shared computers and don't provide access to sensitive information should be allowed to completely opt-out from receiving logout requests from the CSP. The business owner would make the decision to opt-out based on their own risk assessment.

In order to ensure global logout works for all that do need it, it would still remain mandatory for all RPs to send logout requests *to* the CSP. This would continue to happen using front-channel bindings as it does today.