IdpSession Logout Problems

[Chad La Joie]

On Fri, Oct 28, 2011 at 10:52, Skylar Hansen
<shansen at randolphcollege.edu> wrote:
> Our helpdesk recently found that when Firefox is set to save the last
> session, that users are also not being logged out of Shibboleth even if the
> browser window HAS been completely closed. So, if a student logs off of our
> portal on Firefox having been using one of our student lounge computers, and
> another student comes in behind them within the 20 minute window, then the
> next student could be logged in as the previous student. This could result
> in extremely serious privacy concerns and according to management - possible
> violation of FERPA laws. According to Firefox documentation, this is not a
> default setting, but our help desk manager is convinced that this is the
> default behavior.

Yeah, it's the default behavior now.  Web browser vendors have stated
numerous times that they do not view cookies as a security mechanism,
so there is no problem with keep "session" cookies around
indefinitely.  Not much we can do about that, we've tried.

> Another person logged in to our portal via her android phone, and then
> clicked logoff, but found that she was able to get right back into her
> email. She told me that she feels that the IT department has no credibility
> if she cannot logout of her email. Tensions are very high, and people are
> panicking about Shibboleth. It is seen as a huge security hole with little
> benefit.

Then, as Paul said, disable SSO.  Or install the Hungarian SLO
extension, give people what they want and really open up a security
and usability nightmare.

-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered