<div dir="ltr"><div><div><div><div>Hello Scott,<br><br></div>Let me suggest this small code modification which at least allow to any browser to log out the given user:<br><br>286
DatatypeHelper.safeEquals(activeSession.getSessionID(), indexedSession.getSessionID())) {<br><br></div>instead of this please:<br><br>DatatypeHelper.safeEquals(activeSession.getPrincipalName(), indexedSession.getPrincipalName())) {<br>
<br></div>Thanks,<br><br></div>Tamas<br></div><div class="gmail_extra"><br clear="all"><div>VWOL<br>Tamas SZERB <<a href="mailto:toma@rulez.org">toma@rulez.org</a>></div>
<br><br><div class="gmail_quote">On Thu, Jul 3, 2014 at 7:01 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="">On 7/3/14, 9:35 AM, "Szerb, Tamas" <<a href="mailto:toma@rulez.org">toma@rulez.org</a>> wrote:<br>
<br>
><br>
>My question, how to remediate it. We can only use emailAddress at this<br>
>time (and SAML standard), and I believe this use case is quite typical.<br>
<br>
</div>Logout for us has never been a typical or even achievable use case, and<br>
the design limitations in the old code reflect that. You can't remediate<br>
the session limitation unless you want to go in and rewrite the code.<br>
<div class=""><br>
> I also wonder why not having eg. JSESSIONID also used as a key with the<br>
>NameID?<br>
<br>
</div>There was no use of the Java session in V2 except on a short term basis<br>
while handling a request.<br>
<br>
-- Scott<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br></div>