Terminating the IdP Session in an Login Extension

[Joshua Brodie]

Hi Chad:

You are right - I should have thought of that.

I guess I am puzzle why the session persists when user is redirected
off-site - i.e. the user has a session when hitting the back-button.

In fit of desperation, I resort to killing session, via the following
to no avail (after the user clicks on redirect to offsite):

 Cookie[] cookies = request.getCookies();
            if(cookies!=null)
            for (int i = 0; i < cookies.length; i++) {
                log.debug("{COOKIES}{COOKIES} cookies = " +
cookies.toString() + " for count i = " +i);
                Cookie c = request.getCookies()[i];
                c.setMaxAge(-1);
                response.addCookie(c);
            }

On 27 June 2012 09:37, Chad La Joie <lajoie at itumi.biz> wrote:
> For anything like this, you'll need to create a custom login handler.
> If that login handler doesn't return to the authentication engine then
> no session is created so there is no need to destroy it.
>
> On Wed, Jun 27, 2012 at 12:32 PM, Joshua Brodie <josbrodie at gmail.com> wrote:
>> Hi All:
>>
>> Scott suggested that I post question here on the dev mail list.
>>
>> I am creating a login extension, whereby after authentication, it
>> checks if password was not set in last 120 days, and if not, the user
>> sees an info page and can select to be redirected to another
>> application, to reset password (not SSO - re-authentication required
>> in other app as it is a non-Shib).
>>
>> The sticking point:  when user is redirected to another application,
>> their session persists in the IdP - i.e. the user can hit the browser
>> back-button and pick-up where they left off in the IdP - I need to
>> prevent this; i.e. when user is redirected to other app, all IdP
>> session is killed and, if they hit the back-browser button, they will
>> get the standard error.jsp page -
>> would you be able to give pointers on how to achieve this?
>>
>> Thanks.
>> --
>> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
>
>
>
> --
> Chad La Joie
> www.itumi.biz
> trusted identities, delivered
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net