<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Hi everyone,<div><br></div><div>I've discovered that deleting the cookies in the external authentication is not enough. When you have logged out from the SP and you try to re-enter to the SP with a different user, a new authentication process is triggered (and that's what is normally expected, with the deletion of cookies of course), BUT, if you logout of the SP and open another tab and try to re-enter to the SP with a different user, you will be redirected to the idp to start a new authentication process but once you've completed it, you are now logged in, as the previous user, no the last one you enter. </div><div><br></div><div>To summarize:</div><div><br></div><div>1) Go to SP and try to login with user <b>Joan</b></div><div>2) You're redirected to idp (ExternAuthn)</div><div>3) Enter credentials and successfully authenticates</div><div>4) Enter SP</div><div>5) Logout SP</div><div>6) Open a new tab</div><div>7) Go to SP and try to login with user <b>Lucy</b></div><div>8) You're redirected to idp (ExternAuthn)</div><div>9) Enter credentials and succesfully authenticates</div><div>10) Enter SP but you're inside as <b>Joan </b>no as<b> Lucy </b></div><div><b><br></b></div><div><b><span class="Apple-style-span" style="font-weight: normal; ">I believe this happen because the session from the idp is still active and doesn't matter if you delete the cookies, you need to re-authenticate but you can enter with a different user. </span></b></div><div><b><span class="Apple-style-span" style="font-weight: normal; "><br></span></b></div><div><b><span class="Apple-style-span" style="font-weight: normal; ">If anybody can help me please by sharing any knowledge in here about this, it'd be great!</span></b></div><div><b><span class="Apple-style-span" style="font-weight: normal; "><br></span></b></div><div><b><span class="Apple-style-span" style="font-weight: normal; ">My solution was to create a servlet that has a SessionManager<Session> member that it's initialized trough the init method of the servlet and use that object to delete the session like this:</span></b></div><div><b><span class="Apple-style-span" style="font-weight: normal; "><br></span></b></div><div><b><span class="Apple-style-span" style="font-weight: normal; "><span class="Apple-tab-span" style="white-space:pre"> </span>Session idpSession = (Session) request.getAttribute(Session.HTTP_SESSION_BINDING_ATTRIBUTE);</span></b></div><div><b><span class="Apple-style-span" style="font-weight: normal; "><br></span></b></div><div> <span class="Apple-tab-span" style="white-space:pre"> </span>if (idpSession != null) {</div><div><br></div><div> String id = idpSession.getSessionID();</div><div><br></div><div> if(id != null && id.length() > 0) { </div><div> </div><div> sessionManager.destroySession(id); //sessionManager is the member I talked earlier</div><div> </div><div> } </div><div><b><span class="Apple-style-span" style="font-weight: normal; "> } </span></b></div><div><b><span class="Apple-style-span" style="font-weight: normal; "><br></span></b></div><div><b><span class="Apple-style-span" style="font-weight: normal; ">Is this the best way of invalidating the current session of the idp or there are other options?</span></b></div><div><b><span class="Apple-style-span" style="font-weight: normal; "><br></span></b></div><div><b><span class="Apple-style-span" style="font-weight: normal; ">Can I be sure that by doing this (the previous code) there's no interchange of information between users? </span></b></div><div><b><br></b></div><div>Thank you very much for all the help.</div><div><br><div><br></div></div></body></html>