Disable SSO session

[Cantor, Scott]

> Hmmm, that's not the behavior I'm seeing here.

It is, actually.

> 10.214.121.42 - - [07/Jan/2016:11:28:44 -0800] "GET
> /idp/profile/SAML2/Redirect/SSO?execution=e2s1 HTTP/1.1" 302 300
> 10.214.121.42 - - [07/Jan/2016:11:28:44 -0800] "GET
> /idp/Authn/RemoteUser?conversation=e2s1 HTTP/1.1" 302 301
> 10.214.121.42 - - [07/Jan/2016:11:28:44 -0800] "GET
> /idp/profile/SAML2/Redirect/SSO?execution=e2s1&_eventId_proceed=1
> HTTP/1.1" 200 12199

That redirect to /Authn/RemoteUser demonstrates that it's starting over (from the IdP's PoV). You're confusing the CAS client's session with the IdP.

If the IdP was doing SSO, it would not pass control to a login-related "sublocation", but just run straight through on the profile URL.

> There is no redirection back through CAS in this case.  I notice that the
> conversation variable incremented on the second attempt from "e1s1" to
> "e2s1".

CAS is a SSO system. The client would be expected to cache and remember a session.

-- Scott