HA IDPs stateless behind load balancer with authentication via CAS

[Michael A Grady]

On Dec 13, 2013, at 9:36 AM, Cantor, Scott wrote:

> On 12/13/13, 9:36 AM, "Ted Fisher" <tffishe at bgsu.edu> wrote:
> 
>> I think - it's not very pretty.  We have a URL with a big ugly list of
>> every app we know that we provide with SSO which just goes out to each
>> and tries to logout the user session.  Our Apps group maintains that and
>> I simply make sure for each new service we add to Shib or CAS I get a
>> logout URL for that App and forward it to that team who adds it to the
>> big ugly list.  Logout from any page is then supposed to redirect to this
>> global logout URL which just goes everywhere trying to end any open
>> sessions.
> 
> Unless the redirect is in the top level frame/window, then no, that
> doesn't work without third party cookies. Unless you assume the app
> doesn't need the cookie to do a logout, which isn't typical.
> 

Don't know if BGSU is using this technique, but one similar approach that I first saw used at USC was to have such a "master logout page" present all the possible logout links for those services as the SRC for Image tags. That way the user's browser is actually visiting each of those links. Of course, that's a fixed list of services not based on what the user actually used/visited this session, but just the full list of what they might have used that one cares to ensure they are logged out of.

--
Michael A. Grady
Senior IAM Consultant, Unicon, Inc.