SSO session & password change

[Cantor, Scott]

That's just yet another take on administrative logout, the thing we don't support.

There's no simple way to do this, and there's probably no "hard" way. I can think of some incredibly hard ways but nothing I could cook up on the fly.

The MFA flow would have to be set up to run every time, and it would have to be scripted to look for an existing session to pull the username out of, and then do an attribute lookup for something in the directory signaling this.

But that's just the tip of the iceberg, there'd a ton of complex interactions with all the flows to figure out to somehow allow SSO when you want it but not when you don't, and I suspect somewhere in all that a bug or some weird interaction would pop up that makes it harder or impossible.

Not doing SSO is pretty easy, really, but doing it "sometimes", that's much harder.

You need administrative logout, really, that's the bottom line.

A server-side session store would at least allow for the possibility of doing something now, even if it's not really supported or stable, but client-side completely invalidates any sort of "cleanup" model on the back-end; it requires revocation features within the IdP itself, which is...administrative logout (and is also a killer because that's shared state too).

I would like to see us implement a revocation list model for people that want to do it, but there hasn't been time nor sufficient demand (from people that pay for the software).

-- Scott