IdpSession Logout Problems

[Skylar Hansen]

Hello,

 

At my organization we recently went live with a Shibbolized portal and
we are having some severe issues with users being able to logout. We
have the Idp session set to expire after 20 minutes. The portal has a
logout button, but if one does not close the browser window completely,
including all tabs, and any processes open, then when one clicks back on
the portal w/in the 20 minute window, they are instantly re-logged in
via Shibboleth. 

 

Our helpdesk recently found that when Firefox is set to save the last
session, that users are also not being logged out of Shibboleth even if
the browser window HAS been completely closed. So, if a student logs off
of our portal on Firefox having been using one of our student lounge
computers, and another student comes in behind them within the 20 minute
window, then the next student could be logged in as the previous
student. This could result in extremely serious privacy concerns and
according to management - possible violation of FERPA laws. According to
Firefox documentation, this is not a default setting, but our help desk
manager is convinced that this is the default behavior.

 

Another person logged in to our portal via her android phone, and then
clicked logoff, but found that she was able to get right back into her
email. She told me that she feels that the IT department has no
credibility if she cannot logout of her email. Tensions are very high,
and people are panicking about Shibboleth. It is seen as a huge security
hole with little benefit.

 

I am having an extremely difficult time helping my colleagues understand
that the purpose of Shibboleth is sign IN not sign OUT, and that the
main purpose of a portal is integration / interoperability. Having SSO
is a huge part of this, and a huge convenience to users who will very
quickly choose not to use resources that prove too cumbersome, annoying,
or difficult - which signing in over and over again certainly is.

 

I've read numerous threads discussing these issues, and have shared the
recommendation that SLO is not recommended, and a virtually untenable
solution. However, this has gone over like a lead balloon. My management
is about to have me remove Shibboleth from our organization all
together. 

 

Does anyone else have a similar story, lessons learned, or possible
solutions? Any advice would be very much appreciated.

 

Regards,

 

Skylar

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20111028/5e5e651f/attachment.html