IDP Logout, text asking user whether or not to kill the IDP session

[David Bantz]

On Tue, 15 Oct 2013, at 13:46 , Peter Schober <peter.schober at univie.ac.at> wrote:
> 
> 
>  If you want to exit your weblogin (N.B.: name of the service)
>  session please click/choose
> 
>   [[Logout]]
> 
>  <bold>and completely exit your web browser</bold>, e.g. via File ->
>  Quit.
> 
>  Alternatively you can still continue your weblogin session by
>  accessing services directly.
> 
> -peter

Well yes, but even though you kill the IdP / SSO session cookie, 
if the user was logged in to other relying services, then
the browser will have cookies indicating a valid session with that service.
Even adding the step of exiting the browser may still enable a 
subsequent continuation of those other relying services once the 
browser is re-launched and helpfully restores that service session cookie.

AFAIK, if the user doesn't "log out" of all the services first, then then kill 
the SSO session, there may be persistent session cookies.  Alas,
even if we could motivate users to log out of all services then kill the
SSO session, I find services that do not implement any logout: there's 
no way for my IdP or web site to kill the service session cookie.

I'd love to be wrong!


David Bantz
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 163 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://shibboleth.net/pipermail/users/attachments/20131015/660dfce4/attachment-0001.bin