IdpSession Logout Problems

[Paul Hethmon]

Be careful of what you ask for, you may get it.

Welcome to the world of SSO. Where the greatest benefit is also is greatest drawback.

I would turn off sessions entirely. So you don't get SSO, but you do get centralized authentication services. You could look at a shorter session period as well, so a user can login once and open multiple applications within the first few minutes. But it's really about user education and setting proper expectations of how the technology works.

Paul

From: Skylar Hansen <shansen at randolphcollege.edu<mailto:shansen at randolphcollege.edu>>
Reply-To: Shibboleth Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Date: Fri, 28 Oct 2011 10:52:15 -0400
To: Shibboleth Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: IdpSession Logout Problems

Hello,

At my organization we recently went live with a Shibbolized portal and we are having some severe issues with users being able to logout. We have the Idp session set to expire after 20 minutes. The portal has a logout button, but if one does not close the browser window completely, including all tabs, and any processes open, then when one clicks back on the portal w/in the 20 minute window, they are instantly re-logged in via Shibboleth.

Our helpdesk recently found that when Firefox is set to save the last session, that users are also not being logged out of Shibboleth even if the browser window HAS been completely closed. So, if a student logs off of our portal on Firefox having been using one of our student lounge computers, and another student comes in behind them within the 20 minute window, then the next student could be logged in as the previous student. This could result in extremely serious privacy concerns and according to management - possible violation of FERPA laws. According to Firefox documentation, this is not a default setting, but our help desk manager is convinced that this is the default behavior.

Another person logged in to our portal via her android phone, and then clicked logoff, but found that she was able to get right back into her email. She told me that she feels that the IT department has no credibility if she cannot logout of her email. Tensions are very high, and people are panicking about Shibboleth. It is seen as a huge security hole with little benefit.

I am having an extremely difficult time helping my colleagues understand that the purpose of Shibboleth is sign IN not sign OUT, and that the main purpose of a portal is integration / interoperability. Having SSO is a huge part of this, and a huge convenience to users who will very quickly choose not to use resources that prove too cumbersome, annoying, ordifficult – which signing in over and over again certainly is.

I’ve read numerous threads discussing these issues, and have shared the recommendation that SLO is not recommended, and a virtually untenable solution. However, this has gone over like a lead balloon. My management is about to have me remove Shibboleth from our organization all together.

Does anyone else have a similar story, lessons learned, or possible solutions? Any advice would be very much appreciated.

Regards,

Skylar

-- To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20111028/562eb01d/attachment.html