<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Amit,</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Are you sure there is no redirect to the IdP after the logout button is pressed?</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Logout in the application is separate from logout in the IdP. Unless the IdP logout endpoint is reached, the IdP session will stay valid (for 5h as you noted).</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
You could force login, but that has its own compromises [1] </div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Ray</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
[1] <a href="https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2076410043/ForceAuthn">
https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2076410043/ForceAuthn</a></div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Amit Dongaonkar via users <users@shibboleth.net><br>
<b>Sent:</b> April 17, 2026 08:37<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Cc:</b> Amit Dongaonkar <amitd@nitssolutions.com><br>
<b>Subject:</b> Question regarding user logout workflow</font>
<div> </div>
</div>
<style type="text/css" style="display:none">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div class="x_elementToProof" style="font-family:"Calibri Light",sans-serif; font-size:15px; color:rgb(118,113,113)">
Hi Group,</div>
<div class="x_elementToProof" style="font-family:"Calibri Light",sans-serif; font-size:15px; color:rgb(118,113,113)">
I have a question about the user logout workflow. </div>
<div class="x_elementToProof" style="font-family:"Calibri Light",sans-serif; font-size:15px; color:rgb(118,113,113)">
<br>
</div>
<div class="x_elementToProof" style="font-family:"Calibri Light",sans-serif; font-size:15px; color:rgb(118,113,113)">
We have Shibb SP servicing users coming to our platform. During a penetration testing exercise an observation was raised as follows:</div>
<div class="x_elementToProof" style="font-family:"Calibri Light",sans-serif; font-size:15px; color:rgb(118,113,113)">
<br>
</div>
<div class="x_elementToProof" style="font-family:"Calibri Light",sans-serif; font-size:15px; color:rgb(118,113,113)">
When a user hits the logout button on the application he is logged out but when he enters the application URL again in the browser then he is able to get into the application again without get redirected to the IdP for authentication.</div>
<div class="x_elementToProof" style="font-family:"Calibri Light",sans-serif; font-size:15px; color:rgb(118,113,113)">
<br>
</div>
<div class="x_elementToProof" style="font-family:"Calibri Light",sans-serif; font-size:15px; color:rgb(118,113,113)">
Looking at the SAML assertion received for the user I see the following</div>
<div class="x_elementToProof" style="font-family:"Calibri Light",sans-serif; font-size:15px; color:rgb(118,113,113)">
<saml:AuthnStatement SessionIndex="wcfENW_JyI4mCzIxCTeGEo-oH6."</div>
<div class="x_elementToProof" style="font-family:"Calibri Light",sans-serif; font-size:15px; color:rgb(118,113,113)">
SessionNotOnOrAfter="2026-04-17T20:32:43.689Z"</div>
<div class="x_elementToProof" style="font-family:"Calibri Light",sans-serif; font-size:15px; color:rgb(118,113,113)">
AuthnInstant="2026-04-17T15:02:43.460Z"</div>
<div style="font-family:"Calibri Light",sans-serif; font-size:15px; color:rgb(118,113,113)">
></div>
<div class="x_elementToProof" style="font-family:"Calibri Light",sans-serif; font-size:15px; color:rgb(118,113,113)">
So the IdP is saying that the session is valid for roughly 5 hours. </div>
<div class="x_elementToProof" style="font-family:"Calibri Light",sans-serif; font-size:15px; color:rgb(118,113,113)">
<br>
</div>
<div class="x_elementToProof" style="font-family:"Calibri Light",sans-serif; font-size:15px; color:rgb(118,113,113)">
Since the user is trying to access the application as soon as he logs out and its well within 5 hours the application is letting the user in again. Also I see the application sending a auth request to the IdP this time around before letting the user in.</div>
<div class="x_elementToProof" style="font-family:"Calibri Light",sans-serif; font-size:15px; color:rgb(118,113,113)">
<br>
</div>
<div class="x_elementToProof" style="font-family:"Calibri Light",sans-serif; font-size:15px; color:rgb(118,113,113)">
<b>Question</b>: Is this the right behavior and the observation from the pen testing is not valid, if not, then is there a way to invalidate the session once the user logs out from the application so that he is redirected to the IdP for authentication? </div>
<div class="x_elementToProof" style="font-family:"Calibri Light",sans-serif; font-size:15px; color:rgb(118,113,113)">
<br>
</div>
<div class="x_elementToProof" style="font-family:"Calibri Light",sans-serif; font-size:15px; color:rgb(118,113,113)">
Note that we don't have a Single Logout (SLO) URL from the IdP and I prefer to not use it as it will throw him out of all other applications (that's my understanding).</div>
<div class="x_elementToProof" style="font-family:"Calibri Light",sans-serif; font-size:15px; color:rgb(118,113,113)">
<br>
</div>
<div class="x_elementToProof" style="font-family:"Calibri Light",sans-serif; font-size:15px; color:rgb(118,113,113)">
Would appreciate any guidance on this.</div>
<div class="x_elementToProof" style="font-family:"Calibri Light",sans-serif; font-size:15px; color:rgb(118,113,113)">
<br>
</div>
<div class="x_elementToProof" style="font-family:"Calibri Light",sans-serif; font-size:15px; color:rgb(118,113,113)">
<br>
</div>
<div class="x_elementToProof" style="font-family:"Calibri Light",sans-serif; font-size:15px; color:rgb(118,113,113)">
Thanks </div>
<div class="x_elementToProof" style="font-family:"Calibri Light",sans-serif; font-size:15px; color:rgb(118,113,113)">
Amit Dongaonkar</div>
<div class="x_elementToProof" style="font-family:"Calibri Light",sans-serif; font-size:15px; color:rgb(118,113,113)">
<br>
</div>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta content="IE=edge">
<link href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/7.0.1/css/all.min.css"><style type="text/css">
<!--
a[x-apple-data-detectors]
{color:inherit!important;
text-decoration:none!important}
-->
</style>
<div style="font-size:12px; line-height:18px; color:#6b7280"><strong style="color:#111111">CONFIDENTIALITY NOTICE:</strong> This e-mail and any accompanying document(s) contain confidential information which is privileged and intended only for the addressee
hereof. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution or use of this e-mail and/or accompanying document(s) is strictly prohibited. If you have received this e-mail in error, please immediately notify
the sender at the above e-mail address. </div>
</div>
</body>
</html>