Google apps logout script breaks under Tomcat 8?

[Cantor, Scott]

On 3/20/15, 4:52 PM, "Baron Fujimoto" <baron at hawaii.edu> wrote:
>
>Sorry, via CAS3, based on documentation here:
><https://wiki.jasig.org/display/CASUM/Shibboleth-CAS+Integration>

Ok, but in what way would clearing those cookies have any impact on logout? I'm just not seeing it. The IdP's session won't matter. Even if you cleared the JSESSIONID cookie, and even if that were the basis of the CAS session, all that would do is take you back to CAS and you'd be right back in again.

Maybe the script you were using also was doing a CAS logout, but if that's the case, it shouldn't matter what happens with the IdP. You could just turn off the PreviousSession handler and push all the SSO aspects back to CAS.

>I also understand that Tomcat is no longer recommended, but unfortunately
>given our current resources we're not in a position to make the transition
>to an alternative like Jetty at this time. Perhaps at some point in the
>future. :/

I'm just saying that when a piece of software has proven to suck, in exactly the way it's sucking for you, that it probably is connected to something in that layer (as it sort of has to be if that's the only changed variable).

>Are you referring to this?

Yes.

>Our current IdP/Google environment was configured prior to when this
>feature became available I think (v2.4.0?), so we never went back to try
>and retrofit an alternate solution. I don't suppose anyone has a sample
>config for Google (not uncommon, I hope?) they'd be willing to share?

There's no config really, that's just a different URL to tell Google to use. Google doesn't support SAML logout. They're just redirecting, so it's just changing the URL it's using.

-- Scott