Chrome background process affecting logouts

[David Langenberg]

You could enable the IdP's logout support
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPEnableSLO.  No,
it's not true SLO, but it will kill the SSO session.  What our
highly-sensitive apps tend to do, since they don't even trust the user to
close the browser, is use a combination of short-idle timers + forceAuthn.
We have not at this time decided to make any changes to our IdP (or even
enable the SLO features) in response to this.

Dave

On Fri, Feb 20, 2015 at 2:40 PM, Dunn, Adam M <Adam.M.Dunn at uth.tmc.edu>
wrote:

> We've recently been seeing a large number of Chrome users turn up with an
> advanced setting in Chrome to leave it running in the background after
> closing ALL browsers.  None of them seem to have any knowledge of turning
> this on, so it would seem that it's being done by default.
>
> This is a concern to us for SSO enabled applications that leverage local
> logout, where we display an instruction telling users to close all of their
> browser windows if they wish to complete the logout process.  With this
> Chrome setting that practice does you no good since Chrome never really
> closes.
>
> I understand it's a browser issue, and the fix is to tell users to disable
> this, but most users will know nothing about how to muck with these
> settings.  We're looking at pushing an enterprise GPO setting to disable
> this, but that doesn't begin to do anything for personal devices.
>
> Short of using SLO for every app (many of which don't support it), I'm
> curious to know how are others addressing this issue with Chrome?
>
>
> Thanks,
> Adam
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
David Langenberg
Identity & Access Management
The University of Chicago
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150220/1e64e794/attachment-0001.html