CAS logout URI and relation to IdP session

[Scott Koranda]

Hi,

The wiki page for CAS at

https://wiki.shibboleth.net/confluence/display/IDP30/CasProtocolConfiguration

includes this notable limitation:

"There is no support at present for the CAS /logout URI since
global logout/single logout (SLO) in Shibboleth has been
discouraged historically. IdP 3.0 has improved support for
IdP-initiated SLO, which is conceptually similar to the
behavior of the CAS /logout URI, and will be implemented on
top of IdP capabilities in 3.2.0 (tentative)."

So effectively with version 3.1.1 the URL
.../idp/profile/cas/logout is not supported.

Version 3.1.1 does, however, support "local logout" for the
IdP at .../idp/profile/Logout. When that URL is accessed the
IdP session is terminated and, according to my quick tests,
CAS SSO is not available until the user authenticates again.

The CAS protocol specification has for /logout

"/logout destroys a client’s single sign-on CAS session. The
ticket-granting cookie (Section 3.6) is destroyed, and
subsequent requests to /login will not obtain service tickets
until the user again presents primary credentials (and thereby
establishes a new single sign-on session)."

It appears that the IdP "local logout" meets the criteria for
CAS protocol logout. Is there any risk to using it as the "CAS
logout" URL for clients that want to invoke "logout"?

Thanks,

Scott K