IDP logout.jsp

[Michael A Grady]

We (Unicon) dealt with this problem with the Shib-CAS-Authenticator (uses the external authn handler), because it had been keeping its own session. So that's been fixed. But I don't know if the remote-user CAS option has the same problem that the Shib-CAS-Authenticator did -- I'm assuming it must if you are having this problem. I'll find out more about what you'd need to do to fix it. (I think it is a pretty easy fix to an underlying config option in the CAS client setup.)

On Jan 11, 2013, at 6:33 PM, Cantor, Scott wrote:

> On 1/11/13 6:39 PM, "Andrew Morgan" <morgan at orst.edu> wrote:
>> 
>> Maybe I'm doing something wrong...  I have commented out the
>> PreviousSession LoginHandler in handler.xml.  However, I am not being
>> redirected through CAS every time I access the IdP.
> 
> That's up to CAS, not the IdP. I assume like any SSO agent, the CAS client
> maintains a session. It doesn't send you to CAS every time you access a
> server.
> 
>> Is there some interaction with the CAS Client installed in the IdP that
>> is 
>> keeping the session alive?
> 
> I certainly imagine there would be.
> 
>> I see that my Jsession has a
>> _const_cas_assertion_ attribute set, which makes me think that the CAS
>> Client itself is telling the container that I'm still authenticated.
> 
> You're using the REMOTE_USER handler, so it's up to your configured
> authentication code to decide how to get REMOTE_USER set. Nothing to do
> with the IdP in any way. If you want CAS to behave a particular way on
> that end, that would be between you and CAS.
> 
> -- Scott
> 
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


--
Michael A. Grady
Senior IAM Consultant, Unicon, Inc.