partial log of

[Peter Schober]

* Jan Keirse <jan.keirse at tvh.be> [2012-06-21 11:19]:
> However I think it would be desireable and relatively easy to
> provide a 'partial log off.'
> Here is the use case:
> A user has 2 accounts with a service provider. A nice example would be an
> administrative account and a regular account with less privileges for daily
> use.

We also get asked for user/account switching once in a while.

My usual response is Ctrl+Shift+n (on Chromium/Chrome) or whatever
other methods your webbrowser offers to fork off a new window that
does not share state with the rest of the browser.
In most cases firing up an alternative browser (IE, FF, Safari,
Chrome, whathaveyou) is just as quick and easier to understand and has
no side effects whatsoever.

> What I suggest:
> - Provide a log of page in the SSO, when the user navigates to it he is
> logged of from the IdP, but gets a warning that he's might still be logged
> in with the service providers untill he closes his browser .
> - When a service providers provides a log of page it can be used to clear
> the session with the service provider, redirect the user to the Idp Log of
> page -> clear the IdP session.
> Then the user can log in again with another account.

I would expect many institutions are doing that today.
For specific IP ranges (library PC labs) we nuke the IdP session
cookie unconditionally, the rests gets a choice of clicking a button
or moving on, doing nothing to their IdP session.
Not sure this is wise (cf. Scott's previous mail on the subject) but
that's where we're at currently.

> I first tried this:
[...]
> But that didn't work.

Probably the missing path (as the original cookie will be set to the
context's path). Either way, I do that in a Perl CGI script and
there's nothing special to it.
-peter