IDP Logout, text asking user whether or not to kill the IDP session

[Bryan E. Wooten]

You aren't wrong. I wonder if MFA helps this situation?

Sent from my Android phone using TouchDown (www.nitrodesk.com)

-----Original Message-----
From: David Bantz [dabantz at alaska.edu]
Received: Tuesday, 15 Oct 2013, 2:59pm
To: Shib Users [users at shibboleth.net]
Subject: Re: IDP Logout, text asking user whether or not to kill the IDP session

On Tue, 15 Oct 2013, at 13:46 , Peter Schober <peter.schober at univie.ac.at> wrote:
>
>
>  If you want to exit your weblogin (N.B.: name of the service)
>  session please click/choose
>
>   [[Logout]]
>
>  <bold>and completely exit your web browser</bold>, e.g. via File ->
>  Quit.
>
>  Alternatively you can still continue your weblogin session by
>  accessing services directly.
>
> -peter

Well yes, but even though you kill the IdP / SSO session cookie,
if the user was logged in to other relying services, then
the browser will have cookies indicating a valid session with that service.
Even adding the step of exiting the browser may still enable a
subsequent continuation of those other relying services once the
browser is re-launched and helpfully restores that service session cookie.

AFAIK, if the user doesn't "log out" of all the services first, then then kill
the SSO session, there may be persistent session cookies.  Alas,
even if we could motivate users to log out of all services then kill the
SSO session, I find services that do not implement any logout: there's
no way for my IdP or web site to kill the service session cookie.

I'd love to be wrong!


David Bantz
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131015/cafc2154/attachment.html