<font style><font face="arial,helvetica,sans-serif">Hello,</font></font><div style><font><font face="arial,helvetica,sans-serif"><br></font></font></div><div style><font><font face="arial,helvetica,sans-serif">I understand Single sign off can't be easily provided by the Shibboleth IDP because there is no reliable way to know all sessions with the various service providers have been signed off. </font></font></div>
<div style><font><font face="arial,helvetica,sans-serif">However I think it would be desireable and relatively easy to provide a 'partial log off.' </font></font></div><div style><font><font face="arial,helvetica,sans-serif">Here is the use case: </font></font></div>
<div style><font><font face="arial,helvetica,sans-serif">A user has 2 accounts with a service provider. A nice example would be an administrative account and a regular account with less privileges for daily use. When the user wants to use the admin account he has to log off from the regular account. But when he logs of from the service provider and wants to log in again he's automatically redirected to the SSO login page and because he can't log off from it he's logged in again. The only option for him is to close the browser. </font></font></div>
<div style><font><font face="arial,helvetica,sans-serif">What I suggest:</font></font></div><div style><font><font face="arial,helvetica,sans-serif">- Provide a log of page in the SSO, when the user navigates to it he is logged of from the IdP, but gets a warning that he's might still be logged in with the service providers untill he closes his browser .</font></font></div>
<div style><font><font face="arial,helvetica,sans-serif">- When a service providers provides a log of page it can be used to clear the session with the service provider, redirect the user to the Idp Log of page -> clear the IdP session. </font></font></div>
<div style><font><font face="arial,helvetica,sans-serif">Then the user can log in again with another account. </font></font></div><div style><font><font face="arial,helvetica,sans-serif"><br></font></font></div><div style>
<font><font face="arial,helvetica,sans-serif">I believed all this would require to implement is a .jsf page that clears the cookie of the IdP so it shouldn't be very hard, however I tried to do create this myself and it seems that if I clear the cookie in the .jsf it has no effect, setting other cookies does work so probably there's something else in the stack that sets the cookie despite what the .jsf does. </font></font></div>
<div style><font><font face="arial,helvetica,sans-serif">Is what I ask possible using just a logout.jsf page or does it require a little more work? </font></font></div><div style><font><font face="arial,helvetica,sans-serif"><br>
</font></font></div><div style><font><font face="arial,helvetica,sans-serif">I first tried this:</font></font></div><div style><font><font face="arial,helvetica,sans-serif"><br></font></font></div><div style><font><font face="arial,helvetica,sans-serif"><div>
<%</div><div> Cookie idpSessionCookie = new Cookie("_idp_session", null);</div><div> idpSessionCookie.setMaxAge(1);</div><div> </div><div> response.addCookie(idpSessionCookie);</div><div> Cookie testCookie = new Cookie("wonder", "abc");</div>
<div> response.addCookie(testCookie);</div><div>%></div><div><br></div><div>But that didn't work.</div></font></font></div><div style><font><font face="arial,helvetica,sans-serif"><br></font></font></div><div style>
<font><font face="arial,helvetica,sans-serif">I then tried to clear the cookies on the client side using javascript, however the following only works in Chrome, not in IE or Firefox:</font></font></div><div style><font><font face="arial,helvetica,sans-serif"><br>
</font></font></div><div style><pre style="white-space:pre-wrap"><script >
function deleteAllCookies() {
var cookies = document.cookie.split(";");
for (var i = 0; i < cookies.length; i++) {
var cookie = cookies[i];
var eqPos = cookie.indexOf("=");
var name = eqPos > -1 ? cookie.substr(0, eqPos) : cookie;
document.cookie = name + "=;expires=Thu, 01 Jan 1970 00:00:00 GMT";
}
}
deleteAllCookies();
</script></pre><pre style="white-space:pre-wrap"><span style="color:rgb(81,81,81);font-family:Verdana,Arial,Helvetica,sans-serif;font-size:x-small">Kind Regards,</span></pre><div><font face="Verdana, Arial, Helvetica, sans-serif" size="1" color="#515151"><br>
<font size="1" color="#BE1128"><b>JAN KEIRSE</b></font><br><b>CORPORATE SERVICES</b> • <b>Software Engineer</b><br><br><font size="1" color="#BE1128"><b>TVH GROUP NV</b></font><br>Brabantstraat 15 • BE-8790 WAREGEM</font></div>
</div> <div><font face="Verdana, Arial, Helvetica, sans-serif" color="#515151" size="1"><br></font></div>
<br>
<span>DISCLAIMER ****</span><br><br><a href="http://www.tvh.com/newen2/emaildisclaimer/default.html" target="_blank">http://www.tvh.com/newen2/<WBR>emaildisclaimer/default.html</a><span> </span><br><br><span>"This message is delivered to all addressees subject to the conditions</span><br><span>set forth in the attached disclaimer, which is an integral part of this</span><br><span>message."</span>