Skip to content

Sign out of application should also sign out of Shibboleth session #311

Description

@alexstuart

After signing into an account from the UK federation, selecting Sign out will destroy the application session and send the user back to the home page which then displays the Sign In form. However, selecting "sign in with your institutional credentials" immediately logs the user into the application without going round the loop of UK federation Central Discovery Service etc. This is because the sign out functionality does not destroy the Shibboleth session.

You can confirm that the Shibboleth session is not destroyed by the sign out function by signing out and then viewing https://dmponline-test.dcc.ac.uk/Shibboleth.sso/Session -- it continues to report a valid Shibboleth session.

The sign out link should also destroy the Shibboleth session. You can do this by calling the Local Logout handler at https://dmponline-test.dcc.ac.uk/Shibboleth.sso/Logout. Probably best to do this somewhere in code rather than with the user's browser as the behaviour for this link to destroy the session and return a simple page with a HTTP 200 code (whether there was a valid Shibboleth session to logout of or not).

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions