Terminating the IdP Session in an Login Extension

[Chad La Joie]

For anything like this, you'll need to create a custom login handler.
If that login handler doesn't return to the authentication engine then
no session is created so there is no need to destroy it.

On Wed, Jun 27, 2012 at 12:32 PM, Joshua Brodie <josbrodie at gmail.com> wrote:
> Hi All:
>
> Scott suggested that I post question here on the dev mail list.
>
> I am creating a login extension, whereby after authentication, it
> checks if password was not set in last 120 days, and if not, the user
> sees an info page and can select to be redirected to another
> application, to reset password (not SSO - re-authentication required
> in other app as it is a non-Shib).
>
> The sticking point:  when user is redirected to another application,
> their session persists in the IdP - i.e. the user can hit the browser
> back-button and pick-up where they left off in the IdP - I need to
> prevent this; i.e. when user is redirected to other app, all IdP
> session is killed and, if they hit the back-browser button, they will
> get the standard error.jsp page -
> would you be able to give pointers on how to achieve this?
>
> Thanks.
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered