Google apps logout script breaks under Tomcat 8?

[Cantor, Scott]

On 3/25/15, 2:48 AM, "Baron Fujimoto" <baron at hawaii.edu> wrote:


>
>I don't claim to understand why clearing the cookies has any impact on
>logout, but I can reliably reproduce the behaviour that, after logout, if
>I delete the JSESSIONID cookie[*] for the idp host in question with path
>"/idp", then the logout sticks, else not.

Then what you're clearing is the CAS client session. That cookie has no 
effect on the IdP whatsoever.

>After clearing the cookies, the script was subsequently redirecting to the
>CAS logout, which logs the destruction of its Ticket Granting Cookie 
>(TGC).

Then the simple fact is that Tomcat has broken your script and it's no 
longer clearing JSESSIONID.

>Can this accomplished by simply commenting out the PreviousSession
>definition in handler.xml?  I tried that, and also set our Google Apps to
>call the CAS logout directly rather than through the script that deleted
>the cookies first. CAS destroys the session, but the IdP still seems to
>detect a session on the next login attempt (and does not hand off to CAS
>for AuthN).

No. The IdP is doing nothing but passing control to the RemoteUser handler 
for a fresh login and what happens then is not up to the IdP, it's up to 
you. Presumably the CAS client is installed and still has a session and 
it's still passing the username in.

-- Scott

>