Google apps logout script breaks under Tomcat 8?

[Mike Grady's]

> On Mar 24, 2015, at 10:43 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> 
> On 3/25/15, 2:48 AM, "Baron Fujimoto" <baron at hawaii.edu> wrote:
> 
> 
>> 
>> I don't claim to understand why clearing the cookies has any impact on
>> logout, but I can reliably reproduce the behaviour that, after logout, if
>> I delete the JSESSIONID cookie[*] for the idp host in question with path
>> "/idp", then the logout sticks, else not.
> 
> Then what you're clearing is the CAS client session. That cookie has no 
> effect on the IdP whatsoever.
> 
>> After clearing the cookies, the script was subsequently redirecting to the
>> CAS logout, which logs the destruction of its Ticket Granting Cookie 
>> (TGC).
> 
> Then the simple fact is that Tomcat has broken your script and it's no 
> longer clearing JSESSIONID.
> 
>> Can this accomplished by simply commenting out the PreviousSession
>> definition in handler.xml?  I tried that, and also set our Google Apps to
>> call the CAS logout directly rather than through the script that deleted
>> the cookies first. CAS destroys the session, but the IdP still seems to
>> detect a session on the next login attempt (and does not hand off to CAS
>> for AuthN).
> 
> No. The IdP is doing nothing but passing control to the RemoteUser handler 
> for a fresh login and what happens then is not up to the IdP, it's up to 
> you. Presumably the CAS client is installed and still has a session and 
> it's still passing the username in.

The Shibboleth-CAS-Authenticator, using the External Authn handler, will not have that behavior. The CAS client embedded in it will not maintain its own session, and if you turn off PreviousSession on the Identity Provider, the CAS Server logout will be all that is needed to logout of the SSO service.