Modify forceAuthn Authentication Engine Behavior

[Peter Schober]

* John Mitchell <jpmitchell at alaska.edu> [2011-12-16 01:12]:
> I would argue that another option is needed like a supported logout
> method that the application can invoke that logs out up to the
> IdP.

Jfyi, when we started out with Shibboleth (i.e., I probably wouldn't
do that today, but now we're kind of stuck with it) I set up some
simple CGI script in the IdP's webserver which presents a logout
button, which, if submitted, cleared the IdP's session cookie.
If that's not what you wanted (possibly because you assumed 'logout'
was local to the application where you selected this) the page
informas you to resume using web apps as usual.

The script was later adapted to unconditionally and immediately nuke
the IdP's session cookie if the client's IP address was in a specifc
range (in this case representing kiosk PCs in the university library).
After destroying the cookie the page informs the user in "large,
friendly letters" (or was it Evil Red Text? (c)LyX) to end the kioks
session by whatever method was provided for that (some button in the
corner of the screen, or on the webbrowser, IIRC).
Still assumes that people click logout in the application.
But then the app owners do already know that users will have to do
something, as there is no way the software could know that someone
else just walked up to the kisok.

Which brings me to another method, I've heared about (and which I
assume will not delight the app owner): a base place (floor plate?) in
front of the kisok, that triggers killing of the kisok session or
webbrowser when a significant change in applied load is measured.
Even this might not always work (if people step up to the terminal the
same time the other person leaves) but it does /not/ require the user
to care for her own data. (Ignorance WTF!)
-peter