idpSession with emailAddress NameID

[Szerb, Tamas]

Hello Scott,

Let me suggest this small code modification which at least allow to any
browser to log out the given user:

286 DatatypeHelper.safeEquals(activeSession.getSessionID(),
indexedSession.getSessionID())) {

instead of this please:

DatatypeHelper.safeEquals(activeSession.getPrincipalName(),
indexedSession.getPrincipalName())) {

Thanks,

Tamas

VWOL
Tamas SZERB <toma at rulez.org>


On Thu, Jul 3, 2014 at 7:01 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 7/3/14, 9:35 AM, "Szerb, Tamas" <toma at rulez.org> wrote:
>
> >
> >My question, how to remediate it. We can only use emailAddress at this
> >time (and SAML standard), and I believe this use case is quite typical.
>
> Logout for us has never been a typical or even achievable use case, and
> the design limitations in the old code reflect that. You can't remediate
> the session limitation unless you want to go in and rewrite the code.
>
> > I also wonder why not having eg. JSESSIONID also used as a key with the
> >NameID?
>
> There was no use of the Java session in V2 except on a short term basis
> while handling a request.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140704/c8643958/attachment-0001.html