[JIRA] Updated: (SSPCPP-396) Simplify logout support for Native SP

[Scott Cantor (JIRA)]

     [ https://issues.shibboleth.net/jira/browse/SSPCPP-396?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Scott Cantor updated SSPCPP-396:
--------------------------------

    Fix Version/s: 2.5

> Simplify logout support for Native SP
> -------------------------------------
>
>                 Key: SSPCPP-396
>                 URL: https://issues.shibboleth.net/jira/browse/SSPCPP-396
>             Project: Shibboleth SP - C++
>          Issue Type: New Feature
>      Security Level: Standard(Standard bug, may impact functionality but does not represent a security vulnerability ) 
>          Components: SAML 2.0 Logout
>    Affects Versions: 2.4.3
>         Environment: MacOS and CentOS
>            Reporter: sychan at lbl.gov
>            Assignee: Scott Cantor
>            Priority: Minor
>              Labels: Session
>             Fix For: 2.5
>
>
> Logouts from NativeSP shib sessions are not as transparent and clean as logins. Specifically:
> 1) The NativeSP module for Apache will transparently redirect the user to the IdP for login, filling in the return URL. Logouts currently don't have comparable support - the application needs to perform the redirect or Apache rewrite rules need to be created to construct the redirect and return url. It is all doable, but logout support requires a lot more monkeying around than login. Adding this would make it possible for lots of legacy web apps to transparently handle login and logout from shib.
> 2) The names of cookies used for shib sessions are undisclosed. If an application wants to expire the cookies/sessions without doing a redirect the recommended practice is to kill any cookie that doesn't look familiar. This is unsatisfactory and it would be helpful to have some attribute that enumerates the names of the shib session cookies. The particular issue with this is that shib support may be only a single module in a package that has multiple modules, and it isn't possible to know all the cookie names used by other modules. The general problem with this is "hygiene" related - killing state based on a guessing game has unknown side effects.
>    The changes are hopefully trivial to implement, and I think they do improve the usability of the tools - at least for admins and integrators.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira