Terminating the IdP Session in an Login Extension

[Chad La Joie]

On Wed, Jun 27, 2012 at 12:51 PM, Joshua Brodie <josbrodie at gmail.com> wrote:
> They have a session on the tomcat, I initiate this if login
> name/password enetered is correct - I need the session, so that the
> info page that gives details on why they need to update their password
> can be seen by them - only after they click on link on the info page
> are they redirected off to another site (non-Shib). It is this session
> that persists and can be retrieved by hitting the browser back-button
> (after user redirected off-site)

Okay, that has nothing to do with Shib then.  Shib doesn't use the
Tomcat session so if you create it you need to manage it.  Once
control transfers to the login handler it's *all* you.  So if you're
redirecting out to another site and coming back then you need to
convey whatever state you need on the return trip and your login
handler needs to do "the right thing", whatever that means for you.

-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered