IDP logout.jsp

[Andrew Morgan]

On Tue, 13 Nov 2012, Cantor, Scott wrote:

> On 11/13/12 1:07 PM, "Andrew Morgan" <morgan at orst.edu> wrote:
>>
>> Sorry, I don't understand what you mean there.  Let me rephrase...  If I
>> turn off the PreviousSession handler, is the "_idp_session" cookie still
>> used?  If the cookie is still used, what is it used for?
>
> It's used, it's just not particularly relevant to the logout issue. Mike's
> point was that you don't really need to do anything to the IdP if you
> delegate all logins to CAS and just turn off the PreviousSession handler
> in the IdP. All requests for a login will go to CAS, and then it will be
> up to it.

Maybe I'm doing something wrong...  I have commented out the 
PreviousSession LoginHandler in handler.xml.  However, I am not being 
redirected through CAS every time I access the IdP.

Here is a quick snippet from my access logs demonstrating it:

(Call IdP, get redirected to CAS)
[11/Jan/2013:14:55:35 -0800] "GET /idp-dev/profile/SAML2/Unsolicited/SSO?providerId=https%3A%2F%2Fempcenter-dev2.ucsadm.oregonstate.edu HTTP/1.1" 302 3455
[11/Jan/2013:14:55:35 -0800] "GET /idp-dev/AuthnEngine HTTP/1.1" 302 405
[11/Jan/2013:14:55:35 -0800] "GET /idp-dev/Authn/RemoteUser HTTP/1.1" 302 373
[11/Jan/2013:14:55:35 -0800] "GET /cas-dev/login?service=https%3A%2F%2Flogin.oregonstate.edu%2Fidp-dev%2FAuthn%2FRemoteUser HTTP/1.1" 200 3188

(Submit auth credentials to CAS)
[11/Jan/2013:14:55:40 -0800] "POST /cas-dev/login;jsessionid=0476973FC36EDD02DFA6BB169C928385?service=https%3A%2F%2Flogin.oregonstate.edu%2Fidp-dev%2FAuthn%2FRemoteUser HTTP/1.1" 302 645

(IdP CAS client validates CAS Service Ticket and redirects to target)
[11/Jan/2013:14:55:40 -0800] "GET /cas-dev/serviceValidate?ticket=ST-464-BflfgprbFNk130zeHpP4-login1&service=https%3A%2F%2Flogin.oregonstate.edu%2Fidp-dev%2FAuthn%2FRemoteUser HTTP/1.1" 200 2797
[11/Jan/2013:14:55:40 -0800] "GET /idp-dev/Authn/RemoteUser?ticket=ST-464-BflfgprbFNk130zeHpP4-login1 HTTP/1.1" 302 309
[11/Jan/2013:14:55:40 -0800] "GET /idp-dev/Authn/RemoteUser HTTP/1.1" 302 629
[11/Jan/2013:14:55:40 -0800] "GET /idp-dev/profile/SAML2/Unsolicited/SSO HTTP/1.1" 200 4946

(Logout of CAS directly, dumping CASTGC cookie)
[11/Jan/2013:14:56:19 -0800] "GET /cas-dev/logout HTTP/1.1" 200 2869

(Call IdP, but no redirection through CAS happens)
[11/Jan/2013:14:56:57 -0800] "GET /idp-dev/profile/SAML2/Unsolicited/SSO?providerId=https%3A%2F%2Fempcenter-dev2.ucsadm.oregonstate.edu HTTP/1.1" 302 646
[11/Jan/2013:14:56:57 -0800] "GET /idp-dev/AuthnEngine HTTP/1.1" 302 550
[11/Jan/2013:14:56:57 -0800] "GET /idp-dev/Authn/RemoteUser HTTP/1.1" 302 421
[11/Jan/2013:14:56:57 -0800] "GET /idp-dev/profile/SAML2/Unsolicited/SSO HTTP/1.1" 200 4946


Is there some interaction with the CAS Client installed in the IdP that is 
keeping the session alive?  I see that my Jsession has a 
_const_cas_assertion_ attribute set, which makes me think that the CAS 
Client itself is telling the container that I'm still authenticated.

Thanks,
 	Andy