logout concerns

[Andrew Morgan]

On Wed, 13 Aug 2014, lalithj wrote:

>
> Hi All,
>
> We got •	Shibboleth IdP version 2.3.8 running in production, we got various
> third part SPs integrated.
>
>
> So far we have not done any tasks on logout features on behalf of SPs,
>
> Now some SPs are questioning on the behaviour of the logout feature,
>
> Is there a IdP logout URL, which we can provide to SPs,
>
> Currently our IdP is hooked to CAS, and not doing a clean logout expect
> everyone to close all the browser instances.
>
> Let me provide some instruction links to achieve above

I hope you're not trying to perform Single Log-Out (SLO).  By that, I mean 
that you want a logout at the IdP to also logout of all SPs.  As other 
people will tell you, that's a hopeless dream.

However, if you just want to provide a URL that will cause a logout at the 
IdP and CAS, then that is possible.  We do that here with a logout.jsp 
file that we insert into the Shibboleth WAR file 
(shibboleth-identityprovider-2.4.0/src/main/webapp/logout.jsp) before we 
build/install the WAR.

logout.jsp contains:

<%
Cookie c;

c = new Cookie("_idp_session", null);
c.setPath("/idp-dev");
c.setMaxAge(0);
c.setSecure(true);
response.addCookie(c);

c = new Cookie("JSESSIONID", null);
c.setPath("/idp-dev");
c.setMaxAge(0);
c.setSecure(true);
response.addCookie(c);

session.invalidate();
response.sendRedirect("https://login.oregonstate.edu/cas-dev/logout");
%>



As you can see, this deletes the 2 IdP cookies and then redirects the 
browser to the CAS logout page.

We are not using the shib-cas-authenticator here (yet), so this logout 
process may be different if you are integrating CAS with Shibboleth using 
shib-cas-authenticator.

 	Andy