Java Shibboleth SP logout notification receiver

[Robert Egglestone]

The front channel support is quick to add, the back channel support looks like it'll take a lot more effort.

I was thinking along the following lines for Java web apps:

1. A servlet filter adds the Shibboleth session ID to the HttpSession.

2. A container-specific library is installed that given a Shibboleth session ID will iterate through the sessions using the container APIs, and delete the one that matches the Shibboleth session ID.

3. A servlet port of the PHP5 logout code that in the front channel case drops the session, and in the back channel case calls #2.

This assumes that it's either a single server, or running with clustered sessions. If session affinity is being used, then we'd either need to direct the request to the right server (maybe needing additional information in the Shibboleth session?), or sending the logout request to all servers.

Is this on the right track?
Is only supporting the front channel a viable option?

Robert

On 5/05/2012, at 2:09 AM, Cantor, Scott wrote:

> On 5/4/12 12:04 AM, "Robert Egglestone" <r.egglestone at auckland.ac.nz>
> wrote:
>> 
>> Are there any known implementations of the Shibboleth SP logout
>> notification receiver for Java application servers, similar to the PHP
>> sample below?
>> https://wiki.shibboleth.net/confluence/display/SHIB2/SLOWebappAdaptation
> 
> The implementation is supposed to be specific to your environment since
> there's no way for it to do anything useful otherwise. If this is more
> than a few minutes of work (aside from whatever is specific), then I've
> done something very wrong or unintentional in the design.
> 
> 
> -- Scott
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4730 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20120507/23fb8ce7/attachment.bin