IdP V3 logout and RemoteUser Auth Flow using external CAS server

[Cantor, Scott]

> I could see the shib_idp_session_ss and shib_idp_session cookies being
> destroyed when I hit /profile/Logout. (although a JSESSIONID cookie
> remained)  I also destroyed my CAS server session by logging out of
> the CAS server.

Your CAS server session is irrelevant. If CAS doesn't do single logout itself, than the CAS application session on the IdP is still there and that's all that matters.

> I then went though logout of the IdP and CAS server again, but this
> time also destroyed the JSESSIONID cookie mentioned above.
>
> This time I was prompted to login to the IdP/CAS server again as I would
> expect.

Then the CAS client you chose to use is maintaining its session in the container session.

> I presume that the remote_user header is being stored in the
> HttpSession Object stored in the /idp context even though it should
> only have request scope?

No. The identity is being populated by the CAS client (again, that you chose and configured yourself) on each request.

> How would I achieve the logout I desire with a RemoteUser Auth Flow
> using an external CAS server?

Use a different CAS client, or configure it differently, or hack in something into the logout process to clear something that it has no idea how to clear itself.

-- Scott