Configuring return URL on Logout

[Chris Phillips]

A question and some observations:

If the application is stateful, how can you exclusively delegate session management to mod_shib on logout first?

Mod_shib will always do the right thing for mod_shib but things like php's session management (or any other thing -- ruby, Python, cgi, perl etc ) will potentially retain a session of some sort and some form of it somewhere. When the user logs in a second time within the app session window, they will reconnect to an existing session in the app. This is not a shib problem but an app hygiene problem and reason to logout locally first and kill the session.

This will reveal how well or poorly  the in application session management is written. Why? If anything changes between logins within the app session lifetime (30min?) data will change underneath you(eg group membership, name, entitlement etc) that you use to grant privileges in the session instantiation step usually only done on login. It will not be re-evaluated on the subsequent login and you will break your security model for the app because it won't have the latest, most accurate info on the user from the most recent login.

The theory of abstracting things away is healthy but in practice it sounds like to me that you need to logout of the app to allow session cleanup  (remove memory/disk presence of a session) before redirection to mod_shib..

C.

/mobile_____________________
chris.phillips at canarie.ca

> On Jun 18, 2014, at 7:01 AM, "Peter Gillard-Moss" <pgillard at thoughtworks.com> wrote:
> 
> We do this with a hyperlink to /sso/Logout (which goes to mod_shib).  We are trusting that Shibboleth 'does the right thing' here and expires the session.