Configuring return URL on Logout

[Peter Gillard-Moss]

Thanks for the response Chris.

I think there are some very valid points here.

If the application is stateful, how can you exclusively delegate session
> management to mod_shib on logout first?


There is a big depends here.  By tightly binding the session management to
shib this can be achieved. i.e. the session key is based on the NameID
passed by Shibboleth.  Therefore the session is only valid when Shibboleth
is valid.

When the user logs in a second time within the app session window, they
> will reconnect to an existing session in the app.


I don't see this as a problem and in some scenarios is good usability.
 After all, in AWS you logout but whatever was in your basket stays in your
basket.

This will reveal how well or poorly  the in application session management
> is written. Why? If anything changes between logins within the app session
> lifetime (30min?) data will change underneath you(eg group membership,
> name, entitlement etc) that you use to grant privileges in the session
> instantiation step usually only done on login. It will not be re-evaluated
> on the subsequent login and you will break your security model for the app
> because it won't have the latest, most accurate info on the user from the
> most recent login.


Agree.  However I believe this is about overall architecture and design.
 One must clearly separate, and not compound, the responsibilities of
authentication and authorisation.  Shibboleth has the only say over whether
a user is authenticated and what roles etc. that user has.  A user cannot
access the application unless Shibboleth says so.  However the application
must be responsible for enforcing authorisation (based upon the auth
information) and interpreting how that is applied internally (e.g. only
user with admin group can change the colour).  Authorisation must always be
done at the point of need.  i.e. you do not pre-emptively grant privileges
at logon and cache them in the session but assert on every request.  This
is simple to achieve as Shibboleth passes the group membership, name,
entitlement etc. on every request to the underlying app.

Basically, as a golden rule, do _not_ cache stuff from the IdP/Shibboleth
in the application.  I'd consider this bad practice.

This way you can safely logout without killing you session as there is
nothing in the session related to authorisation (name, group membership
etc.).

Do you think the above approach covers these concerns?




On 18 June 2014 12:52, Chris Phillips <Chris.Phillips at canarie.ca> wrote:

> A question and some observations:
>
> If the application is stateful, how can you exclusively delegate session
> management to mod_shib on logout first?
>
> Mod_shib will always do the right thing for mod_shib but things like php's
> session management (or any other thing -- ruby, Python, cgi, perl etc )
> will potentially retain a session of some sort and some form of it
> somewhere. When the user logs in a second time within the app session
> window, they will reconnect to an existing session in the app. This is not
> a shib problem but an app hygiene problem and reason to logout locally
> first and kill the session.
>
> This will reveal how well or poorly  the in application session management
> is written. Why? If anything changes between logins within the app session
> lifetime (30min?) data will change underneath you(eg group membership,
> name, entitlement etc) that you use to grant privileges in the session
> instantiation step usually only done on login. It will not be re-evaluated
> on the subsequent login and you will break your security model for the app
> because it won't have the latest, most accurate info on the user from the
> most recent login.
>
> The theory of abstracting things away is healthy but in practice it sounds
> like to me that you need to logout of the app to allow session cleanup
>  (remove memory/disk presence of a session) before redirection to mod_shib..
>
> C.
>
> /mobile_____________________
> chris.phillips at canarie.ca
>
> > On Jun 18, 2014, at 7:01 AM, "Peter Gillard-Moss" <
> pgillard at thoughtworks.com> wrote:
> >
> > We do this with a hyperlink to /sso/Logout (which goes to mod_shib).  We
> are trusting that Shibboleth 'does the right thing' here and expires the
> session.
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
Peter Gillard-Moss
Developer | ThoughtWorks | TechOps
http://www.thoughtworks.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140619/6afe0553/attachment.html