[JIRA] Commented: (SSPCPP-396) Simplify logout support for Native SP

[Scott Cantor (JIRA)]

    [ https://issues.shibboleth.net/jira/browse/SSPCPP-396?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13957#comment-13957 ] 

Scott Cantor commented on SSPCPP-396:
-------------------------------------

Sorry for being obtuse, but I didn't understand the requirement for (1) when you first suggested it and I still don't quite see what it is you want there. I think you'll need to supply a concrete example as to what you think such a feature should do, exactly. There are a hundred things that one could expect a request to a URL to do where logout is concerned, so you seem to have something particular in mind that you think is self-evident. I'm not sure it's as general as you think it is, but I'll listen.

The second item is clear.

> Simplify logout support for Native SP
> -------------------------------------
>
>                 Key: SSPCPP-396
>                 URL: https://issues.shibboleth.net/jira/browse/SSPCPP-396
>             Project: Shibboleth SP - C++
>          Issue Type: New Feature
>      Security Level: Standard(Standard bug, may impact functionality but does not represent a security vulnerability ) 
>          Components: SAML 2.0 Logout
>         Environment: MacOS and CentOS
>            Reporter: sychan at lbl.gov
>            Assignee: Scott Cantor
>            Priority: Minor
>              Labels: Session
>             Fix For: 2.5
>
>   Original Estimate: 4 hours
>  Remaining Estimate: 4 hours
>
> Logouts from NativeSP shib sessions are not as transparent and clean as logins. Specifically:
> 1) The NativeSP module for Apache will transparently redirect the user to the IdP for login, filling in the return URL. Logouts currently don't have comparable support - the application needs to perform the redirect or Apache rewrite rules need to be created to construct the redirect and return url. It is all doable, but logout support requires a lot more monkeying around than login. Adding this would make it possible for lots of legacy web apps to transparently handle login and logout from shib.
> 2) The names of cookies used for shib sessions are undisclosed. If an application wants to expire the cookies/sessions without doing a redirect the recommended practice is to kill any cookie that doesn't look familiar. This is unsatisfactory and it would be helpful to have some attribute that enumerates the names of the shib session cookies. The particular issue with this is that shib support may be only a single module in a package that has multiple modules, and it isn't possible to know all the cookie names used by other modules. The general problem with this is "hygiene" related - killing state based on a guessing game has unknown side effects.
>    The changes are hopefully trivial to implement, and I think they do improve the usability of the tools - at least for admins and integrators.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira