Cookie destruction

[Mark O'Quinn]

Hi everyone,

I've discovered that deleting the cookies in the external authentication is not enough. When you have logged out from the SP and you try to re-enter to the SP with a different user, a new authentication process is triggered (and that's what is normally expected, with the deletion of cookies of course), BUT, if you logout of the SP and open another tab and try to re-enter to the SP with a different user, you will be redirected to the idp to start a new authentication process but once you've completed it, you are now logged in, as the previous user, no the last one you enter. 

To summarize:

1) Go to SP and try to login with user Joan
2) You're redirected to idp (ExternAuthn)
3) Enter credentials and successfully authenticates
4) Enter SP
5) Logout SP
6) Open a new tab
7) Go to SP and try to login with user Lucy
8) You're redirected to idp (ExternAuthn)
9) Enter credentials and succesfully authenticates
10) Enter SP but you're inside as Joan no as Lucy 

I believe this happen because the session from the idp is still active and doesn't matter if you delete the cookies, you need to re-authenticate but you can enter with a different user. 

If anybody can help me please by sharing any knowledge in here about this, it'd be great!

My solution was to create a servlet that has a SessionManager<Session> member that it's initialized trough the init method of the servlet  and use that object to delete the session like this:

	Session idpSession = (Session) request.getAttribute(Session.HTTP_SESSION_BINDING_ATTRIBUTE);

     	if (idpSession != null) {

            String id = idpSession.getSessionID();

            if(id != null && id.length() > 0) {        
        
                sessionManager.destroySession(id);   //sessionManager is the member I talked earlier
        
            } 
        }  

Is this the best way of invalidating the current session of the idp or there are other options?

Can I be sure that by doing this (the previous code) there's no interchange of information between users? 

Thank you very much for all the help.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20121128/87a17459/attachment.html