IdP V3 logout and RemoteUser Auth Flow using external CAS server

[Michael A Grady]

> On Jul 8, 2016, at 3:28 PM, Cantor, Scott <cantor.2 at OSU.EDU> wrote:
> 
>> 
>> How would I achieve the logout I desire with a RemoteUser Auth Flow
>> using an external CAS server?
> 
> Use a different CAS client, or configure it differently, or hack in something into the logout process to clear something that it has no idea how to clear itself.
> 
> -- Scott

As Carl at Lafayette suggested, use  https://github.com/Unicon/shib-cas-authn3. It's "CAS client" won't keep it's own session, it supports passing thru Forced (and passive) Authn requests, it passes thru the SP entityID and requested authn context, so you can choose to act on those in the CAS Server. (We'd usually recommend disabling the IdP SSO session altogether in the IdP, so you only have to do the logout at the CAS Server, no IdP SSO session to end. SSO comes from the CAS Server in that scenario.)

--
Michael A. Grady
IAM Architect, Unicon, Inc.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 842 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://shibboleth.net/pipermail/users/attachments/20160708/26c023cd/attachment-0001.sig>