Google apps logout script breaks under Tomcat 8?

[Cantor, Scott]

On 3/20/15, 3:57 PM, "Baron Fujimoto" <baron at hawaii.edu> wrote:

>We're using IdPv2 with Google Apps (via RemoteUser for AuthN). We
>also use a logout script, cribbed from the shib-users mailing list,
>for Google's logout function.

RemoteUser via what?

Neither of the cookies you're trying to overwrite would affect the SSO state if the authentication is done somewhere else. Was this using form-auth via Tomcat?

>This was working until I upgraded from the IdP's servelet container from
>Tomcat 6 to Tomcat 8. Since then, the cookies no longer seem to get wiped.
>Users are still logged in if they revist any of the Google Apps.

One of the reasons we're done with Tomcat as a recommended container is that every release breaks cookies in some weird way. That started back in 6.

But aside from that, what I would say is that you should not be depending on cookie names like that. If you want the IdP to logout, use the logout endpoint.

-- Scott