IDP Logout, text asking user whether or not to kill the IDP session

[Cantor, Scott]

On 10/17/13 2:59 AM, "Brian Tingle" <Brian.Tingle at ucop.edu> wrote:

>> On Oct 16, 2013, at 8:52 PM, "Jim Fox" <fox at washington.edu> wrote:
>
>> 
>> You are not really logged out of anything until you throw your
>>workstation into saltwater.
>
>What is recommended practice to educate service users regarding this
>issue.  In one app we are developing, we just don't have a "logout"
>option.  The other app is 3rd party app and has a "logout" that only
>nominally logs you out of the app but not the IdP.

I try and get those turned off or hidden as best I can. Or I redirect them
to a page that tries to explain they aren't actually logged out.

Some apps don't even let you do that, but that's a consequence of bad SSO
integration.

>Is this just something we should note in the privacy policy or the terms
>of use or help documentation?

I think it's worthless unless it's put in front of them at the time they
try and do something relevant to the topic.

>Also; re: "nothing is easy" -- fair enough but it reminds me of a meeting
>I was in years ago about cross campus authentication for a 3rd party
>application where I told a director "this is pretty complicated"
>basically over and over till she got mad and yelled "well, make it
>simple!" at me.

We (not me personally) did, and then Mozilla decided to break it all, and
Google thought that sounded like a great idea and joined them.

As some have noted, this isn't about logout, it's about shared devices.
Disabling SSO on such devices or at user request seems like a very prudent
approach.

-- Scott