<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: "Calibri Light", sans-serif; font-size: 15px; color: rgb(118, 113, 113);">
Hi Group,</div>
<div class="elementToProof" style="font-family: "Calibri Light", sans-serif; font-size: 15px; color: rgb(118, 113, 113);">
I have a question about the user logout workflow. </div>
<div class="elementToProof" style="font-family: "Calibri Light", sans-serif; font-size: 15px; color: rgb(118, 113, 113);">
<br>
</div>
<div class="elementToProof" style="font-family: "Calibri Light", sans-serif; font-size: 15px; color: rgb(118, 113, 113);">
We have Shibb SP servicing users coming to our platform. During a penetration testing exercise an observation was raised as follows:</div>
<div class="elementToProof" style="font-family: "Calibri Light", sans-serif; font-size: 15px; color: rgb(118, 113, 113);">
<br>
</div>
<div class="elementToProof" style="font-family: "Calibri Light", sans-serif; font-size: 15px; color: rgb(118, 113, 113);">
When a user hits the logout button on the application he is logged out but when he enters the application URL again in the browser then he is able to get into the application again without get redirected to the IdP for authentication.</div>
<div class="elementToProof" style="font-family: "Calibri Light", sans-serif; font-size: 15px; color: rgb(118, 113, 113);">
<br>
</div>
<div class="elementToProof" style="font-family: "Calibri Light", sans-serif; font-size: 15px; color: rgb(118, 113, 113);">
Looking at the SAML assertion received for the user I see the following</div>
<div class="elementToProof" style="font-family: "Calibri Light", sans-serif; font-size: 15px; color: rgb(118, 113, 113);">
<saml:AuthnStatement SessionIndex="wcfENW_JyI4mCzIxCTeGEo-oH6."</div>
<div class="elementToProof" style="font-family: "Calibri Light", sans-serif; font-size: 15px; color: rgb(118, 113, 113);">
SessionNotOnOrAfter="2026-04-17T20:32:43.689Z"</div>
<div class="elementToProof" style="font-family: "Calibri Light", sans-serif; font-size: 15px; color: rgb(118, 113, 113);">
AuthnInstant="2026-04-17T15:02:43.460Z"</div>
<div style="font-family: "Calibri Light", sans-serif; font-size: 15px; color: rgb(118, 113, 113);">
></div>
<div class="elementToProof" style="font-family: "Calibri Light", sans-serif; font-size: 15px; color: rgb(118, 113, 113);">
So the IdP is saying that the session is valid for roughly 5 hours. </div>
<div class="elementToProof" style="font-family: "Calibri Light", sans-serif; font-size: 15px; color: rgb(118, 113, 113);">
<br>
</div>
<div class="elementToProof" style="font-family: "Calibri Light", sans-serif; font-size: 15px; color: rgb(118, 113, 113);">
Since the user is trying to access the application as soon as he logs out and its well within 5 hours the application is letting the user in again. Also I see the application sending a auth request to the IdP this time around before letting the user in.</div>
<div class="elementToProof" style="font-family: "Calibri Light", sans-serif; font-size: 15px; color: rgb(118, 113, 113);">
<br>
</div>
<div class="elementToProof" style="font-family: "Calibri Light", sans-serif; font-size: 15px; color: rgb(118, 113, 113);">
<b>Question</b>: Is this the right behavior and the observation from the pen testing is not valid, if not, then is there a way to invalidate the session once the user logs out from the application so that he is redirected to the IdP for authentication? </div>
<div class="elementToProof" style="font-family: "Calibri Light", sans-serif; font-size: 15px; color: rgb(118, 113, 113);">
<br>
</div>
<div class="elementToProof" style="font-family: "Calibri Light", sans-serif; font-size: 15px; color: rgb(118, 113, 113);">
Note that we don't have a Single Logout (SLO) URL from the IdP and I prefer to not use it as it will throw him out of all other applications (that's my understanding).</div>
<div class="elementToProof" style="font-family: "Calibri Light", sans-serif; font-size: 15px; color: rgb(118, 113, 113);">
<br>
</div>
<div class="elementToProof" style="font-family: "Calibri Light", sans-serif; font-size: 15px; color: rgb(118, 113, 113);">
Would appreciate any guidance on this.</div>
<div class="elementToProof" style="font-family: "Calibri Light", sans-serif; font-size: 15px; color: rgb(118, 113, 113);">
<br>
</div>
<div class="elementToProof" style="font-family: "Calibri Light", sans-serif; font-size: 15px; color: rgb(118, 113, 113);">
<br>
</div>
<div class="elementToProof" style="font-family: "Calibri Light", sans-serif; font-size: 15px; color: rgb(118, 113, 113);">
Thanks </div>
<div class="elementToProof" style="font-family: "Calibri Light", sans-serif; font-size: 15px; color: rgb(118, 113, 113);">
Amit Dongaonkar</div>
<div class="elementToProof" style="font-family: "Calibri Light", sans-serif; font-size: 15px; color: rgb(118, 113, 113);">
<br>
</div>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<title>NITS Email Signature</title>
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/7.0.1/css/all.min.css"><style type="text/css">
@media only screen and (max-width: 620px) {
.container { width: 100% !important; }
.stack { display: block !important; width: 100% !important; }
}
a[x-apple-data-detectors] { color: inherit !important; text-decoration: none !important; }
</style><!-- Confidentiality Notice -->
<div style="font-size:12px; line-height:18px; color:#6b7280;"><strong style="color:#111111;">CONFIDENTIALITY NOTICE:</strong> This e-mail and any accompanying document(s) contain confidential information which is privileged and intended only for the addressee
hereof. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution or use of this e-mail and/or accompanying document(s) is strictly prohibited. If you have received this e-mail in error, please immediately notify
the sender at the above e-mail address. </div>
</body>
</html>