partial log of

[Jan Keirse]

Hello,

I understand Single sign off can't be easily provided by the Shibboleth IDP
because there is no reliable way to know all sessions with the various
service providers have been signed off.
However I think it would be desireable and relatively easy to provide a
'partial log off.'
Here is the use case:
A user has 2 accounts with a service provider. A nice example would be an
administrative account and a regular account with less privileges for daily
use. When the user wants to use the admin account he has to log off from
the regular account. But when he logs of from the service provider and
wants to log in again he's automatically redirected to the SSO login page
and because he can't log off from it he's logged in again. The only option
for him is to close the browser.
What I suggest:
- Provide a log of page in the SSO, when the user navigates to it he is
logged of from the IdP, but gets a warning that he's might still be logged
in with the service providers untill he closes his browser .
- When a service providers provides a log of page it can be used to clear
the session with the service provider, redirect the user to the Idp Log of
page -> clear the IdP session.
Then the user can log in again with another account.

I believed all this would require to implement is a .jsf page that clears
the cookie of the IdP so it shouldn't be very hard, however I tried to do
create this myself and it seems that if I clear the cookie in the .jsf it
has no effect, setting other cookies does work so probably there's
something else in the stack that sets the cookie despite what the .jsf
does.
Is what I ask possible using just a logout.jsf page or does it require a
little more work?

I first tried this:

<%
     Cookie idpSessionCookie = new Cookie("_idp_session", null);
     idpSessionCookie.setMaxAge(1);

     response.addCookie(idpSessionCookie);
     Cookie testCookie = new Cookie("wonder", "abc");
     response.addCookie(testCookie);
%>

But that didn't work.

I then tried to clear the cookies on the client side using javascript,
however the following only works in Chrome, not in IE or Firefox:

<script >
      function deleteAllCookies() {
      var cookies = document.cookie.split(";");

      for (var i = 0; i < cookies.length; i++) {
          var cookie = cookies[i];
          var eqPos = cookie.indexOf("=");
          var name = eqPos > -1 ? cookie.substr(0, eqPos) : cookie;
          document.cookie = name + "=;expires=Thu, 01 Jan 1970 00:00:00 GMT";
      }
  }
  deleteAllCookies();
</script>

Kind Regards,


*JAN KEIRSE*
*CORPORATE SERVICES* • *Software Engineer*

*TVH GROUP NV*
Brabantstraat 15 • BE-8790 WAREGEM

-- 
DISCLAIMER ****

http://www.tvh.com/newen2/emaildisclaimer/default.html 

"This message is delivered to all addressees subject to the conditions
set forth in the attached disclaimer, which is an integral part of this
message."
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120621/114a3fa8/attachment.html