Google apps logout script breaks under Tomcat 8?

[Baron Fujimoto]

On Fri, Mar 20, 2015 at 08:11:28PM +0000, Cantor, Scott wrote:
>On 3/20/15, 3:57 PM, "Baron Fujimoto" <baron at hawaii.edu> wrote:
>
>>We're using IdPv2 with Google Apps (via RemoteUser for AuthN). We
>>also use a logout script, cribbed from the shib-users mailing list,
>>for Google's logout function.
>
>RemoteUser via what?

Sorry, via CAS3, based on documentation here:
<https://wiki.jasig.org/display/CASUM/Shibboleth-CAS+Integration>

>Neither of the cookies you're trying to overwrite would affect the SSO state if the authentication is done somewhere else. Was this using form-auth via Tomcat?
>
>>This was working until I upgraded from the IdP's servelet container from
>>Tomcat 6 to Tomcat 8. Since then, the cookies no longer seem to get wiped.
>>Users are still logged in if they revist any of the Google Apps.
>
>One of the reasons we're done with Tomcat as a recommended container is that every release breaks cookies in some weird way. That started back in 6.

I also understand that this cookie method is not officially supported.
If the referenced cookies aren't the magic ingredient, then I'll also
confess I have no idea why it works with Tomcat 6, but not 8.

I also understand that Tomcat is no longer recommended, but unfortunately
given our current resources we're not in a position to make the transition
to an alternative like Jetty at this time. Perhaps at some point in the
future. :/

>But aside from that, what I would say is that you should not be depending on cookie names like that. If you want the IdP to logout, use the logout endpoint.

Are you referring to this?

<https://wiki.shibboleth.net/confluence/display/SHIB2/IdPEnableSLO>

Our current IdP/Google environment was configured prior to when this
feature became available I think (v2.4.0?), so we never went back to try
and retrofit an alternate solution. I don't suppose anyone has a sample
config for Google (not uncommon, I hope?) they'd be willing to share?

-baron
-- 
Baron Fujimoto <baron at hawaii.edu> :: UH Information Technology Services
minutas cantorum, minutas balorum, minutas carboratum desendus pantorum