Shibboleth logout redirection problem

[Cantor, Scott]

> Since we migrated our CAS protocol support from Jasig CAS to Shibboleth
> over the winter break, I've had this same request from our customers.

And so they assume, I guess, that they are the only app in the world and there is no single logout. Which may be true, but it wasn't the design of the feature to date.

> I was considering adding some simple URL parameter processing to
> logout.vm.  If the parameter is present, write a simple message to the
> screen with the provided (sanitized) URL.
> 
> It sounds like you're saying that won't work, but I don't understand why.

It depends when in the flow a particular view is running, but the initial parameters are gone as soon as it transits a view and back into the flow, and we don't support that parameter in terms of the interface to the system, so it's not preserved anywhere.

It can be preserved, and that may or may not be possible without doing system changes, likely not, but doing an entirely custom flow basically means that you can do anything you want and sidesteps that. And of course, you now have to copy all the Java code, etc. if you want to avoid breakage.

That's why I'm saying outright, it's not a feature for anybody not prepared to do significant work.

At this point, I've reached a sort of compromise with myself and am prepared to start thinking about what we need to do to blow up the logout UI and get all the options into it, because I've concluded the "single logout with reporting of results" is itself a security risk not worth deploying (by me). As such, I don't care if it's accessible, so I don't have to fix that. That gives me some freedom to park that problem and start thinking about all the rest of the UI issues.

I'm also sort of stuck because we've been trying to get the SOAP logout stuff done, and that has a lot of complexity as it turns out, so I need to park that mentally too, so I can move on the rest.

-- Scott