apache / apache/grails-core

Single Signout issue/question

Open
#15,920 1 comment 0 reactions 0 assignees View on GitHub
relates-to:spring-security
Dominant language
Groovy
Stars
2.9k
Forks
975
Avg merge
1d 22h
Merged PRs (30d)
92

Description

I've configured CAS and several services. Everything is okay except one feature - single logout.
When user goes to /logout on a service, he logout on the service and redirects to CAS. After that CAS sends POST requests to all registered (which has been authenticated) services where request is handled by `org.jasig.cas.client.session.SingleSignOutFilter` which calls `destroySession` method of `org.jasig.cas.client.session.SingleSignOutHandler`. In that method we find session by token and call `session.invalidate()`. Looks good, but it doesn't make user (authenticated on the other services) logged out. He will still authenticated on the services, where he didn't call /logout.
It seems we need to do something else with spring security session. But I'm not sure what exactly. Probably we need to remove session information in `SessionRegistry` like: `sessionRegistry.removeSessionInformation(sessionId);` But if so, I'm a little bit confused why it's not realized. Could you please clarify how to deal with this situation? And If I understand things wrong correct me if possible.
Thanks in advance!

Contributor guide

Open the contributing guide

Research direction

Start with org.jasig.cas.client.session.SingleSignOutFilter and SingleSignOutHandler.destroySession, then inspect how Spring Security manages sessions and SessionRegistry entries. Reproduce logout across the registered services and determine whether invalidating the CAS client session should also remove the corresponding Spring Security session state; done means a clear, supported resolution or documented limitation.

Written by the indexing model from the issue text.

Assessment

Tech stack
spring
Domain
authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.