Single log out across all service providers

[Brian Reindel]

Hi Lanxin,

You can really only benefit from this simple approach if your IdP and
SPs are all on the same primary domain or subdomains because of the
security constraints surrounding deleting cookies. The approach is
basically as follows:

1.) Modified the shibboleth2.xml so that the default Sessions
cookieProps and all ApplicationOverride > Sessions reads as follows:
cookieProps="; path=/; secure".
2.) IdP is at subdomain1.primarydomain.com/idp and three service
providers are at subdomain2.primarydomain.com/sp1,
subdomain2.primarydomain.com/sp2 and subdomain2.primarydomain.com/sp3.
3.) When the user clicks a logout link in any of the service providers
we first delete all cookies that start with "_shibsession_". We don't
have to know about the path, since it is now "/", and any sessions
created in any of the service providers are now deleted.
4.) The user is then redirected to a custom logout servlet on the
identity provider at /idp/Authn/Logout, and we delete the JSESSIONID
cookie for the /idp path and the _idp_session cookie, and then return
a view indicating they are logged out.

At that point if the user accessed any of the service providers they
would be prompted for a login. It was made more complicated by the
fact that our identity provider is on a subdomain, and our service
providers are on another subdomain. If your identity provider is on
the root domain (www.primarydomain.com) then you won't need step #3
because the identity provider can delete the subdomain cookies. You
would just need to change your cookieProps=";
domain=.primarydomain.com; path=/; secure".

Let me know if you have any questions.

Brian

On Fri, Sep 13, 2013 at 2:13 AM, MA Lanxin <ma at ihep.ac.cn> wrote:
> Hello  Brian,
>
>> We actually don't need to implement any front-channel or back-channel
>> notifications for internal application session management because our
>> IdP and all of our SPs are in the same security domain. We're going to
>> end up deleting all domain cookies from the identity provider, which
>> will in turn kill all sessions. I've tested in Firebug by removing all
>> cookies after login, and it appears to be working.
>>
>> Considering we're not running a federation (even in our enterprise) I
>> guess we're lucky. I know this solution would not work for most
>> people.
>
> It seems that you alreday have implemented single logout in your domain.
> Could you please explain more detail how you do that. Which version of Idp and Sps
> do you use ? Did you develop a code which deleting all sessions cookies from IdP?
>
> I need to do the same thing in my authentication based shibboleth.
> My IdP and SPs are in the same domain. I am using IdP 2.3.8 and SP 2.4.3 or SP 2.5
>
> Thanks in advance!
>
> Best regards,
> Lanxin
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net