Question regarding user logout workflow

[Amit Dongaonkar]

Hi Ray,
Thanks for sharing the link.
There is no redirect to the IdP on the logout button .
I am having the team look at the force login option and its impact now.

Regards,

Amit Dongaonkar


________________________________
From: users <users-bounces at shibboleth.net> on behalf of Ray Bon via users <users at shibboleth.net>
Sent: Friday, April 17, 2026 1:44 PM
To: Shib Users <users at shibboleth.net>
Cc: Ray Bon <rbon at uvic.ca>
Subject: Re: Question regarding user logout workflow

CAUTION : EXTERNAL SENDER | Proceed carefully when clicking links or opening attachments.
Amit,

Are you sure there is no redirect to the IdP after the logout button is pressed?
Logout in the application is separate from logout in the IdP. Unless the IdP logout endpoint is reached, the IdP session will stay valid (for 5h as you noted).
You could force login, but that has its own compromises [1]

Ray

[1] https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2076410043/ForceAuthn
________________________________
From: users <users-bounces at shibboleth.net> on behalf of Amit Dongaonkar via users <users at shibboleth.net>
Sent: April 17, 2026 08:37
To: Shib Users <users at shibboleth.net>
Cc: Amit Dongaonkar <amitd at nitssolutions.com>
Subject: Question regarding user logout workflow

Hi Group,
I have a question about the user logout workflow.

We have Shibb SP servicing users coming to our platform. During a penetration testing exercise an observation was raised as follows:

When a user hits the logout button on the application he is logged out but when he enters the application URL again in the browser then he is able to get into the application again without get redirected to the IdP for authentication.

Looking at the SAML assertion received for the user I see the following
        <saml:AuthnStatement SessionIndex="wcfENW_JyI4mCzIxCTeGEo-oH6."
                             SessionNotOnOrAfter="2026-04-17T20:32:43.689Z"
                             AuthnInstant="2026-04-17T15:02:43.460Z"
                             >
So the IdP is saying that the session is valid for roughly 5 hours.

Since the user is trying to access the application as soon as he logs out and its well within 5 hours the application is letting the user in again. Also I see the application sending a auth request to the IdP this time around before letting the user in.

Question: Is this the right behavior and the observation from the pen testing is not valid, if not, then is there a way to invalidate the session once the user logs out from the application so that he is redirected to the IdP for authentication?

Note that we don't have a Single Logout (SLO) URL from the IdP and I prefer to not use it as it will throw him out of all other applications (that's my understanding).

Would appreciate any guidance on this.


Thanks
Amit Dongaonkar

CONFIDENTIALITY NOTICE: This e-mail and any accompanying document(s) contain confidential information which is privileged and intended only for the addressee hereof. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution or use of this e-mail and/or accompanying document(s) is strictly prohibited. If you have received this e-mail in error, please immediately notify the sender at the above e-mail address.
CONFIDENTIALITY NOTICE: This e-mail and any accompanying document(s) contain confidential information which is privileged and intended only for the addressee hereof. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution or use of this e-mail and/or accompanying document(s) is strictly prohibited. If you have received this e-mail in error, please immediately notify the sender at the above e-mail address.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260421/2fc54bf9/attachment.htm>