SLO

[Bennett, Steve]

I'm a bit new to Shibboleth, so maybe I'm being daft..

We use CoSign for WebSSO, and it supports single logout. We have a number of local webapps that use CoSign for authentication, and one of the things that I imagine happening is that people will be confused about Shibboleth apps not being logged out when they do a CoSign logout - from a users point of view there's very little indication of whether an app uses CoSign directly or whether it uses Shibboleth (which uses CoSign for AuthN). 

We probably reduce the confusion by explaining and documenting the behaviour, but it made me wonder: there's a comment in conf/handlers.xml on the PreviousSession handler that says:
    Removal of this login handler will disable SSO support, that is it will require the user to authenticate 
    on every request.
If I understand it right, removing this handler would mean that logins would reauthenticate on every request, which would fall through to CoSign (which implements SSO and SLO). So would this give us better Single Logout behaviour, or would it cause something else to fail messily?

Obviously this will still be far from ideal, since an SP wouldn't be notified of a logout occurring and can continue using the existing credentials but it would prevent the scenario where a user authenticates to use one SP, does a CoSign logout, and reauthenticates as a different user and then finds that *all* SPs (not just the previously used one) still use the old credentials.

I totally agree with closing the browser being the best approach in general. Private Browsing mode is also a pretty handy method for reducing the disruption of switching between different sessions.

Steve.

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Martin Haase
Sent: 08 March 2013 09:54
To: Shib Users
Subject: Re: SLO

Am 07.03.2013 20:42, schrieb Cantor, Scott:
> On 3/7/13 2:39 PM, "Paul Hethmon" <paul.hethmon at clareitysecurity.com>
> wrote:
>
>> At the end of the day, closing the browser is still the safest 
>> approach (though still not foolproof).
How can we be sure that there is no browser instance remaining in memory?

> Really, this should be modified to "clear cookies". That is really the 
> way you logout on the web today,
I doubt even half of today's user even know what cookies are in the first place...

> and as far as I can tell, that's a long-term state of affairs.
>
> That assumes that actually works, but if clearing cookies doesn't 
> actually clear cookies...
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to 
> users-unsubscribe at shibboleth.net

--
-----------------------------------------------------------------------
Dr. Martin Haase
DAASI International GmbH                   phone:     +49 7071 407109-6
Europaplatz 3                              Fax  :     +49 7071 407109-9
D-72072 Tübingen                           email: Martin.Haase at DAASI.de
Germany                                    Web  :   http://www.daasi.de

Directory Applications for Advanced Security and Information Management
-----------------------------------------------------------------------