Terminating the IdP Session in an Login Extension

[Joshua Brodie]

Hi Chad:

My apologies to you and Scott for barking up the wrong tree - thank
you for all your help.

I am at my wits end trying terminate the session (non-shibb; regular
tomcat) - the following two listed below did not do the trick.

Am I missing something obvious? Any pointers will be greatly appreciated.

1) session.invalidate() or

2) Cookie[] cookies = request.getCookies();
            if(cookies!=null)
            for (int i = 0; i < cookies.length; i++) {
                log.debug("{COOKIES}{COOKIES} cookies = " +
cookies.toString() + " for count i = " +i);
                Cookie c = request.getCookies()[i];
                c.setMaxAge(-1);
                response.addCookie(c);
            }

On 27 June 2012 09:58, Chad La Joie <lajoie at itumi.biz> wrote:
> On Wed, Jun 27, 2012 at 12:51 PM, Joshua Brodie <josbrodie at gmail.com> wrote:
>> They have a session on the tomcat, I initiate this if login
>> name/password enetered is correct - I need the session, so that the
>> info page that gives details on why they need to update their password
>> can be seen by them - only after they click on link on the info page
>> are they redirected off to another site (non-Shib). It is this session
>> that persists and can be retrieved by hitting the browser back-button
>> (after user redirected off-site)
>
> Okay, that has nothing to do with Shib then.  Shib doesn't use the
> Tomcat session so if you create it you need to manage it.  Once
> control transfers to the login handler it's *all* you.  So if you're
> redirecting out to another site and coming back then you need to
> convey whatever state you need on the return trip and your login
> handler needs to do "the right thing", whatever that means for you.
>
> --
> Chad La Joie
> www.itumi.biz
> trusted identities, delivered
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net