<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; ">
<div>
<div>
<div>Be careful of what you ask for, you may get it.</div>
<div><br>
</div>
<div>Welcome to the world of SSO. Where the greatest benefit is also is greatest drawback.</div>
<div><br>
</div>
<div>I would turn off sessions entirely. So you don't get SSO, but you do get centralized authentication services. You could look at a shorter session period as well, so a user can login once and open multiple applications within the first few minutes. But
it's really about user education and setting proper expectations of how the technology works.</div>
<div><br>
</div>
<div>Paul</div>
<div><br>
</div>
</div>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Skylar Hansen <<a href="mailto:shansen@randolphcollege.edu">shansen@randolphcollege.edu</a>><br>
<span style="font-weight:bold">Reply-To: </span>Shibboleth Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Date: </span>Fri, 28 Oct 2011 10:52:15 -0400<br>
<span style="font-weight:bold">To: </span>Shibboleth Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Subject: </span>IdpSession Logout Problems<br>
</div>
<div><br>
</div>
<div xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">
<meta name="Generator" content="Microsoft Word 11 (filtered medium)">
<style>
<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:Arial;
color:windowtext;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div lang="EN-US" link="blue" vlink="purple">
<div class="Section1">
<p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt;
font-family:Arial">Hello,<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt;
font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt;
font-family:Arial">At my organization we recently went live with a Shibbolized portal and we are having some severe issues with users being able to logout. We have the Idp session
set to expire after 20 minutes. The portal has a logout button, but if one does not close the browser window completely, including all tabs, and any processes open, then when one clicks back on the portal w/in the 20 minute window, they are instantly re-logged
in via Shibboleth. <o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt;
font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt;
font-family:Arial">Our helpdesk recently found that when Firefox is set to save the last session, that users are also not being logged out of Shibboleth even if the browser window
HAS been completely closed. So, if a student logs off of our portal on Firefox having been using one of our student lounge computers, and another student comes in behind them within the 20 minute window, then the next student could be logged in as the previous
student. This could result in extremely serious privacy concerns and according to management - possible violation of FERPA laws. According to Firefox documentation, this is not a default setting, but our help desk manager is convinced that this is the default
behavior.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt;
font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt;
font-family:Arial">Another person logged in to our portal via her android phone, and then clicked logoff, but found that she was able to get right back into her email. She told
me that she feels that the IT department has no credibility if she cannot logout of her email. Tensions are very high, and people are panicking about Shibboleth. It is seen as a huge security hole with little benefit.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt;
font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt;
font-family:Arial">I am having an extremely difficult time helping my colleagues understand that the purpose of Shibboleth is sign IN not sign OUT, and that the main purpose of
a portal is integration / interoperability. Having SSO is a huge part of this, and a huge convenience to users who will very quickly choose not to use resources that prove too cumbersome, annoying, ordifficult – which signing in over and over again certainly
is.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt;
font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt;
font-family:Arial">I’ve read numerous threads discussing these issues, and have shared the recommendation that SLO is not recommended, and a virtually untenable solution. However,
this has gone over like a lead balloon. My management is about to have me remove Shibboleth from our organization all together.
<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt;
font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt;
font-family:Arial">Does anyone else have a similar story, lessons learned, or possible solutions? Any advice would be very much appreciated.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt;
font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt;
font-family:Arial">Regards,<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt;
font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="3" face="Times New Roman"><span style="font-size:
12.0pt">Skylar<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="3" face="Times New Roman"><span style="font-size:
12.0pt"><o:p> </o:p></span></font></p>
</div>
</div>
</div>
-- To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a></span>
</body>
</html>