force termination of SSO session?

[Cantor, Scott]

On 7/23/21, 3:16 AM, "users on behalf of Peter Schober" <users-bounces at shibboleth.net on behalf of peter.schober at univie.ac.at> wrote:

>    Would it be possible to have the authn subsystem(s) check back with
>    the account lockout status in a future release before succeeding?

Lockout is based on the username (and usually a client address) that gets passed into authentication and in the stage you're talking about that's long gone and is quite likely something completely different in many deployments after normalization. Plus since it's generally address specific, it's easy to circumvent in exactly the situations an administrative logout would be trying to address.

I think the suggestion to use a directory attribute is probably more appropriate, and that can easily fail closed if desired.

-- Scott