Terminating the IdP Session in an Login Extension

[Joshua Brodie]

Hi Chad:

Me bad - they haven't logged into Shibboleth IdP per say at this stage.

They have a session on the tomcat, I initiate this if login
name/password enetered is correct - I need the session, so that the
info page that gives details on why they need to update their password
can be seen by them - only after they click on link on the info page
are they redirected off to another site (non-Shib). It is this session
that persists and can be retrieved by hitting the browser back-button
(after user redirected off-site)

Only if they don't have to update password, or choose not to update
password, are they 'logged-in' to the IdP. (this part is regular Shibb
workflow))


On 27 June 2012 09:45, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 6/27/12 12:42 PM, "Joshua Brodie" <josbrodie at gmail.com> wrote:
>>
>>I guess I am puzzle why the session persists when user is redirected
>>off-site - i.e. the user has a session when hitting the back-button.
>
> Session with that? If they haven't logged in yet, they can't have a
> session that means anything for a later request.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net