Chrome background process affecting logouts

[Dunn, Adam M]

Dave, thanks.  That’s a good point about forced re-authentication.  While it erodes the idea behind SSO, I think it could help mitigate this problem for the time being on some important apps.

From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of David Langenberg
Sent: Friday, February 20, 2015 3:52 PM
To: Shib Users
Subject: Re: Chrome background process affecting logouts

You could enable the IdP's logout support https://wiki.shibboleth.net/confluence/display/SHIB2/IdPEnableSLO<https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_display_SHIB2_IdPEnableSLO&d=AwMFaQ&c=6vgNTiRn9_pqCD9hKx9JgXN1VapJQ8JVoF8oWH1AgfQ&r=Ri6WeaSB__co_pfxpFYxuHcYBY05bStjH_HuZWtd23Y&m=KiRzARf6VwIfOvU2xb5ym8Zml3fkqIOEOZWcLfkjEFM&s=quClsGMZWB3_s1WeD_lqk7dKg2WdiNO7uXH2SMIA4lU&e=>.  No, it's not true SLO, but it will kill the SSO session.  What our highly-sensitive apps tend to do, since they don't even trust the user to close the browser, is use a combination of short-idle timers + forceAuthn.  We have not at this time decided to make any changes to our IdP (or even enable the SLO features) in response to this.

Dave

On Fri, Feb 20, 2015 at 2:40 PM, Dunn, Adam M <Adam.M.Dunn at uth.tmc.edu<mailto:Adam.M.Dunn at uth.tmc.edu>> wrote:
We've recently been seeing a large number of Chrome users turn up with an advanced setting in Chrome to leave it running in the background after closing ALL browsers.  None of them seem to have any knowledge of turning this on, so it would seem that it's being done by default.

This is a concern to us for SSO enabled applications that leverage local logout, where we display an instruction telling users to close all of their browser windows if they wish to complete the logout process.  With this Chrome setting that practice does you no good since Chrome never really closes.

I understand it's a browser issue, and the fix is to tell users to disable this, but most users will know nothing about how to muck with these settings.  We're looking at pushing an enterprise GPO setting to disable this, but that doesn't begin to do anything for personal devices.

Short of using SLO for every app (many of which don't support it), I'm curious to know how are others addressing this issue with Chrome?


Thanks,
Adam
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>



--
David Langenberg
Identity & Access Management
The University of Chicago
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150220/bc3fb674/attachment-0001.html