Accessing the logout feature

[Cantor, Scott]

On 6/20/12 1:41 PM, "Stapleton, Steven J. (James)" <stapleton.41 at osu.edu>
wrote:

>No, I tried insisting that the logout feature was not a good idea, but
>some people are insisting we need it (there is currently no logout
>button). Could you provide me with some convincing links about /why/ no
>option other than 'close all browser windows' would be a good idea? They
>won't listen to me.

None of the options are a good idea, that¹s kind of the problem.

The best option (to my mind) is to not do SSO on shared machines and/or at
least offer a user choice of "I'm on a public machine" when logging in.

The reasons the Shibboleth project has not implemented logout to date are
in the wiki in a topic called SLOIssues, and suffice to say there simply
aren't consensus views in the world about it. Usually when management
types start in on it here, it takes me a few minutes asking questions and
raising edge cases before they back off. OSU leadership does not generally
have the will to solve hard problems. This one's hard.

What the best intermediate options are is open to debate. If what you want
to do is support logout of your application and the SSO session, ignoring
all other applications, then you can contact me or webauth-admin offlist.

I do accept that there's an argument that having *no* widget leads to
confusion. The problem is what happens when they click the widget. As I
said at the top, when all the answers are bad, I don't know what the right
answer is.

-- Scott