<div dir="ltr">BTW: using mod_alias with a Redirect rule worked a treat.<div><br></div><div>Would be still interested in feedback on our method and improvements that could be made.</div></div><div class="gmail_extra"><br><br>
<div class="gmail_quote">On 18 June 2014 12:01, Peter Gillard-Moss <span dir="ltr"><<a href="mailto:pgillard@thoughtworks.com" target="_blank">pgillard@thoughtworks.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">Thanks for the quick response Peter. Perhaps let's talk in terms of goals instead.<div><br></div><div>In order to keep our applications simple and ensure security (as in we know they're not using some poorly written SAML gem) we front our app with mod_shib. The apps themselves no nothing of SSO or auth, no sessions etc. etc.. They are completely dumb and wholly on Shibboleth to "do the right thing".</div>
<div><br></div><div>So, in our apache config we have mod_proxy at / and mod_shib at /sso</div><div><br></div><div>In terms of logout we wish the user to be able to initiate a logout sequence from the app. The first step (when the user clicks 'Log out') is to instruct Shibboleth to logout of the app locally. We do this with a hyperlink to /sso/Logout (which goes to mod_shib). We are trusting that Shibboleth 'does the right thing' here and expires the session.</div>
<div><br></div><div>To continue the logout sequence we then wish to redirect to the IdP. The IdP can then display its status with a clear message that you are still logged in at a global level and give a clear option to logout globally. Now, we understand the caveats of the fact that other individual apps may or still have session active etc. but that is an entirely different avenue from my OP. For the moment, 'the best' we can do is display messages and make it clear to the user what is going on.</div>
<div><br></div><div>Another reason for local logout is so, if the IdP has been logged out, but the Shibboleth session is still active, the user can still initiate logout from our app.</div><div><br></div><div>So at the moment we are achieving this with a link to /sso/Logout?return=<a href="http://IdP/status" target="_blank">http://IdP/status</a>. For a number of sound reasons we <i>don't</i> want the application to be in control of the return URL (we don't want them to even know of its existence). We want this to be configured in Shibboleth once and the exact same configuration passed to all apps.</div>
<div><br></div><div>Does the above make sense? Happy to be advised on methods of improving the above.</div><span class="HOEnZb"><font color="#888888"><div><br></div><div>Peter</div></font></span></div><div class="gmail_extra">
<div><div class="h5"><br><br><div class="gmail_quote">On 18 June 2014 10:13, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">* Peter Gillard-Moss <<a href="mailto:pgillard@thoughtworks.com" target="_blank">pgillard@thoughtworks.com</a>> [2014-06-18 10:56]:<br>
<div>> We need to provide local logout and we are using the URL /Logout<br>
> successfully. However we wish to redirect to the IdP which displays a<br>
> status page of your SSO status and the status of applications logged into.<br>
> It also gives a clear logout button.<br>
<br>
</div>"Need" local logout is weird in itself, but combining that requirement<br>
(local logout == don't tell the IDP about it) with a page at the IDP<br>
that claims to be able to track SSO status and logged out applications<br>
is "interesting".<br>
<div><br>
> >From the documentation we can't decipher how to configure shibboleth to<br>
> redirect to our URL. The only thing we've found is to put the URL as a<br>
> value to the return query string parameter. We would far prefer to<br>
> configure this within Shibboleth thus allowing applications to be<br>
> completely ignorant (and avoid people getting it wrong, allowing it to<br>
> change etc.).<br>
<br>
</div>"People" meaning SP administrators, right? Because end users will<br>
always be able to do whatever they want with URLs you present them.<br>
<br>
I don't think there's a way to do that. Either way it would be<br>
something the SP or websever admin would have to configure herself<br>
anyway. And a simple Redirect directive in httdp would achieve that,<br>
no? Are you asking this specifically because you intend to generate<br>
shibboleth2.xml files for SPs of yours? That's the only use-case I<br>
can imagine where having something inside shibboleth2.xml could save<br>
the admin this one step.<br>
-peter<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br><br clear="all"><div><br></div></div></div><div class="">-- <br><div dir="ltr"><div><span>Peter Gillard-Moss</span></div><div><span>Developer | ThoughtWorks | TechOps</span></div><div><a href="http://www.thoughtworks.com" target="_blank">http://www.thoughtworks.com</a></div>
<div><br></div></div>
</div></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr"><div><span>Peter Gillard-Moss</span></div><div><span>Developer | ThoughtWorks | TechOps</span></div><div><a href="http://www.thoughtworks.com" target="_blank">http://www.thoughtworks.com</a></div>
<div><br></div></div>
</div>