<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" id="owaParaStyle"></style>
</head>
<body style="word-wrap:break-word" fpstyle="1" ocsi="0">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">
<div>
<div>
<div class="BodyFragment" style="font-family: Tahoma; font-size: 13px;"><font size="2">I think we have an approach that we are going to try, but it may be some time down the road before we test it out (due to project timelines). With only the default ADFS IdP
available, if I login to O365 and then manually go to the ADFS logout URL, I appear to be logged out of ADFS as well as the O365 portal. The login page still has a cookie with my username, and asks me if I want to login as that user, but if I click on that,
i'm logged out. I'm not completely familiar with the ADFS side, but I've seen the ADFS admin work with the various dialogs. </font></div>
<div class="BodyFragment" style="font-family: Tahoma; font-size: 13px;"><font size="2"><br>
</font></div>
<div class="BodyFragment" style="font-family: Tahoma; font-size: 13px;"><font size="2">Here is my proposed, yet untested solution
</font></div>
<div class="BodyFragment">
<ul>
<li><font size="2" style="font-family: Tahoma; font-size: 10pt;">Set the logout url to be </font><span style="font-size: small;">https://<ADFS-SERVER-DOMAIN>/adfs/ls/?nossl=1&wreply=<CAS-LOGOUT-URL>&wa=wsignout1.0&lc=1033</span></li><li>Update the onload.js file in ADFS, and add JS so that if the query param wreply equals the CAS logout URL, and wa equals wsignout1.0, then redirect to the CAS logout URL</li></ul>
Again, it will probably be a while before we are able to test this in our dev environment. Maybe some other ADFS3/Shib users can chime in if they think this will work.</div>
<div class="BodyFragment"><br>
</div>
<div class="BodyFragment">-Ben</div>
</div>
</div>
<div>
<hr tabindex="-1">
<div id="divRpF937250" style="color: rgb(0, 0, 0); font-family: 'Times New Roman'; font-size: 16px; direction: ltr;">
<font face="Tahoma" size="2" color="#000000"><b>From:</b> users [users-bounces@shibboleth.net] on behalf of Michael A Grady [mgrady@unicon.net]<br>
<b>Sent:</b> Tuesday, May 05, 2015 12:08 AM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: Logout of O365/Shib/CAS<br>
</font><br>
</div>
<div style="color: rgb(0, 0, 0); font-family: 'Times New Roman'; font-size: 16px;">
</div>
<div style="color: rgb(0, 0, 0); font-family: 'Times New Roman'; font-size: 16px;">
<br>
<div>
<div>On May 4, 2015, at 10:37 PM, Michael A Grady <<a href="mailto:mgrady@unicon.net" target="_blank">mgrady@unicon.net</a>> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div style="font-family:Helvetica; font-size:14px; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px">
<div><br>
</div>
</div>
<div style="font-family:Helvetica; font-size:14px; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px">
But if you set the logout URL to go to the CAS logout, and then have that redirect the user back to a URL you create on the ADFS Server, you could probably get what you want. Install IIS, and have a simple .Net app that just clears any and all cookies for the
ADFS service. (Windows can co-exist ADFS and IIS's use of :443 on the same IP Address.) Redirect to that after the CAS logout. Not elegant, but seems a better option than messing with the dlls. </div>
<div style="font-family:Helvetica; font-size:14px; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px">
<br>
</div>
</blockquote>
<br>
</div>
<div>That's assuming you don't need to be able to read those cookies to find their names, because ADFS is scoping its cookies to /adfs, and you likely can't get your own script to be on that path. I can't find a definitive reference on what all the cookie names
are, and the meaning of each, but one can at least see what they are thru live headers and looking at the cookies in your browser.</div>
<div><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica;"><span class="Apple-style-span" style="border-collapse:separate; color:rgb(0,0,0); font-family:Helvetica; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:2; text-indent:0px; text-transform:none; white-space:normal; widows:2; word-spacing:0px">
<div style="word-wrap:break-word"><span class="Apple-style-span" style="border-collapse:separate; color:rgb(0,0,0); font-family:Helvetica; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:2; text-indent:0px; text-transform:none; white-space:normal; widows:2; word-spacing:0px">
<div style="word-wrap:break-word"><br>
--<br>
Michael A. Grady<br>
Senior IAM Consultant, Unicon, Inc.</div>
</span></div>
</span></span></div>
<br>
</div>
</div>
</div>
</body>
</html>