You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@cxf.apache.org by Julius Francis <ju...@zurich.com> on 2012/09/11 09:40:08 UTC
Logout from Fediz from single web application.
Hi All,
We are using Fediz in our web application . Would like to know
what we need to do to logout from web application . If we call
HttpSession.invalidate() , fediz takes controls and redirects to IDP where
the session is still active . Also I do understand the session is
created at tomcal level , how to we invalidate from application . Please
share if someone has already done.
What we want is that when user clicks on logout link , he should be
redirected to login page . How to tell IDP to redirect to login page
?(which means how to kill already existing session).
Thanks and Regards,
__________________________________________
Julius Francis
******************* PLEASE NOTE *******************
This message, along with any attachments, may be confidential or legally
privileged. It is intended only for the named person(s), who is/are the
only authorized recipients. If this message has reached you in error,
kindly destroy it without review and notify the sender immediately. Thank
you for your help.
RE: Logout from Fediz from single web application.
Posted by Oliver Wulff <ow...@talend.com>.
Hi there
There were several requests to support single sign out. It should be fairly simple to support it on the plugin side which should support your use case where ADFS is the IDP. It's more effort and some other jiras must be addressed first on the fediz idp side.
We will come back with a roadmap proposal.
Thanks
Oli
------
Oliver Wulff
Blog: http://owulff.blogspot.com
Solution Architect
http://coders.talend.com
Talend Application Integration Division http://www.talend.com
________________________________________
From: Glen Mazza [gmazza@talend.com]
Sent: 21 September 2012 15:38
To: users@cxf.apache.org
Subject: Re: Logout from Fediz from single web application.
Yeah, sorry I couldn't help you, I earlier encouraged Oli on the CXF-Dev
list to prioritize that if he can in Fediz' next release.
Glen
On 09/20/2012 03:59 PM, Gina Choi wrote:
> I just found out that Fediz1.0.1 does not support Single Sign Out and there
> is a JIRA case openned for this.
> https://issues.apache.org/jira/browse/FEDIZ-19#comment-13459898. I just
> voted for it.
>
> Thanks.
>
> Gina
>
>
>
>
>
> --
> View this message in context: http://cxf.547215.n5.nabble.com/Logout-from-Fediz-from-single-web-application-tp5713780p5714358.html
> Sent from the cxf-user mailing list archive at Nabble.com.
--
Glen Mazza
Talend Community Coders - coders.talend.com
blog: www.jroller.com/gmazza
Re: Logout from Fediz from single web application.
Posted by Glen Mazza <gm...@talend.com>.
Yeah, sorry I couldn't help you, I earlier encouraged Oli on the CXF-Dev
list to prioritize that if he can in Fediz' next release.
Glen
On 09/20/2012 03:59 PM, Gina Choi wrote:
> I just found out that Fediz1.0.1 does not support Single Sign Out and there
> is a JIRA case openned for this.
> https://issues.apache.org/jira/browse/FEDIZ-19#comment-13459898. I just
> voted for it.
>
> Thanks.
>
> Gina
>
>
>
>
>
> --
> View this message in context: http://cxf.547215.n5.nabble.com/Logout-from-Fediz-from-single-web-application-tp5713780p5714358.html
> Sent from the cxf-user mailing list archive at Nabble.com.
--
Glen Mazza
Talend Community Coders - coders.talend.com
blog: www.jroller.com/gmazza
Re: Logout from Fediz from single web application.
Posted by Gina Choi <gi...@gmail.com>.
I just found out that Fediz1.0.1 does not support Single Sign Out and there
is a JIRA case openned for this.
https://issues.apache.org/jira/browse/FEDIZ-19#comment-13459898. I just
voted for it.
Thanks.
Gina
--
View this message in context: http://cxf.547215.n5.nabble.com/Logout-from-Fediz-from-single-web-application-tp5713780p5714358.html
Sent from the cxf-user mailing list archive at Nabble.com.
Re: Logout from Fediz from single web application.
Posted by Gina Choi <gi...@gmail.com>.
Hi Glen,
It has been a while. I hope you are doing well.
<<<
While it may "let user pass through without prompting credentials", the user
still cannot do any meaningful functionality, correct? I.e., any
updates/new reads/writes, etc.? The user is just seeing static info from
the time he did have a connect, right?
>>>
When I call http session invalidate (), it only takes care of removing
cookies for my application. It can't remove cookies with STS. So, since
cookies with STS is still alive, user is not prompted any credentials (this
is after user logout, try to logon using same browser) and he/she is
authenticated and create a new session with my application gain. This gives
user impression, he never clicked logout request.
I was thinking of, if we can send a logout request to STS when user logout
from the application. How does Fediz support single log out? I think that I
asked this question before, but don't remember what was the answer.
Thanks.
Gina
--
View this message in context: http://cxf.547215.n5.nabble.com/Logout-from-Fediz-from-single-web-application-tp5713780p5714356.html
Sent from the cxf-user mailing list archive at Nabble.com.
Re: Logout from Fediz from single web application.
Posted by Glen Mazza <gm...@talend.com>.
While it may "let user pass through without prompting credentials", the
user still cannot do any meaningful functionality, correct? I.e., any
updates/new reads/writes, etc.? The user is just seeing static info
from the time he did have a connect, right? If so, I think your
question is a general web application coding question (how do I blank
out pages from the user's cache), probably best asked on the user's
mailing list of the specific web service framework (Struts, Spring MVC,
etc.) you're using.
Glen
On 09/18/2012 05:42 PM, Gina Choi wrote:
> I am using fediz-1.0.1 for SSO my application's Single Sign On. My STS is
> ADFS2.0. When user clicks logout, we invalidate http session, but later if
> the user browses any page of my application, it doesn't redirect user to
> ADFS and let user pass through without prompting credentials. So, only way
> to completely log out from my application is, user also need to either clear
> up browser cookies or close the browser. This might causes confusion to
> users. Any thought?
>
> Thanks.
>
> Gina Choi
>
>
>
> --
> View this message in context: http://cxf.547215.n5.nabble.com/Logout-from-Fediz-from-single-web-application-tp5713780p5714103.html
> Sent from the cxf-user mailing list archive at Nabble.com.
--
Glen Mazza
Talend Community Coders - coders.talend.com
blog: www.jroller.com/gmazza
RE: Logout from Fediz from single web application.
Posted by Gina Choi <gi...@gmail.com>.
I am using fediz-1.0.1 for SSO my application's Single Sign On. My STS is
ADFS2.0. When user clicks logout, we invalidate http session, but later if
the user browses any page of my application, it doesn't redirect user to
ADFS and let user pass through without prompting credentials. So, only way
to completely log out from my application is, user also need to either clear
up browser cookies or close the browser. This might causes confusion to
users. Any thought?
Thanks.
Gina Choi
--
View this message in context: http://cxf.547215.n5.nabble.com/Logout-from-Fediz-from-single-web-application-tp5713780p5714103.html
Sent from the cxf-user mailing list archive at Nabble.com.
RE: Logout from Fediz from single web application.
Posted by Julius Francis <ju...@zurich.com>.
Hi Oliver,
Thanks for the information . Will raise the JIRA request.
Thanks and Regards,
__________________________________________
Julius Francis
From: Oliver Wulff <ow...@talend.com>
To: "users@cxf.apache.org" <us...@cxf.apache.org>
Date: 09/12/2012 11:22 PM
Subject: RE: Logout from Fediz from single web application.
Hi Julius
If you terminate the http session you are logged out of the web
application. If you access the web application again, the container
notices this is an unauthenticated request and triggers a redirect to the
IDP.
If your browser still has got a valid session with the IDP it will just
create a new token for the web application without challenging the user to
authenticate as you expect from SSO.
WS-Federation defines the single log out use case which means that you log
out in the IDP and he will log out all existing sessions with *all* web
applications. The session between the IDP and the browser is terminated as
well. Next time you access a web application, the IDP will challenge you
again.
If an application requires to re-authenticate a browser user or requires a
"fresh" token, an application can express this requirement by adding the
wfresh parameter as part of the signin request. See section 13.2.2 in [1].
>>>
wfresh
This OPTIONAL parameter indicates the freshness requirements. If
specified, this indicates the desired maximum age of authentication
specified in minutes. An IP/STS SHOULD NOT issue a token with a longer
lifetime. If specified as “0” it indicates a request for the IP/STS to
re-prompt the user for authentication before issuing the token. Note
that this serves roughly the same purpose as the Freshness element in the
WS-Trust SOAP RST messages.
>>>
Fediz doesn't support this parameter yet. It requires an enhancement for
the fediz plugin as well as the fediz idp. Feel free to raise a JIRA
request thus this requirement can be tracked.
Thanks
Oli
[1]
http://docs.oasis-open.org/wsfed/federation/v1.2/os/ws-federation-1.2-spec-os.html
------
Oliver Wulff
Blog: http://owulff.blogspot.com
Solution Architect
http://coders.talend.com
Talend Application Integration Division http://www.talend.com
________________________________________
From: Julius Francis [julius.francis@zurich.com]
Sent: 11 September 2012 09:40
To: users@cxf.apache.org
Subject: Logout from Fediz from single web application.
Hi All,
We are using Fediz in our web application . Would like to know
what we need to do to logout from web application . If we call
HttpSession.invalidate() , fediz takes controls and redirects to IDP where
the session is still active . Also I do understand the session is
created at tomcal level , how to we invalidate from application . Please
share if someone has already done.
What we want is that when user clicks on logout link , he should be
redirected to login page . How to tell IDP to redirect to login page
?(which means how to kill already existing session).
Thanks and Regards,
__________________________________________
Julius Francis
******************* PLEASE NOTE *******************
This message, along with any attachments, may be confidential or legally
privileged. It is intended only for the named person(s), who is/are the
only authorized recipients. If this message has reached you in error,
kindly destroy it without review and notify the sender immediately. Thank
you for your help.
******************* PLEASE NOTE *******************
This message, along with any attachments, may be confidential or legally
privileged. It is intended only for the named person(s), who is/are the
only authorized recipients. If this message has reached you in error,
kindly destroy it without review and notify the sender immediately. Thank
you for your help.
RE: Logout from Fediz from single web application.
Posted by Oliver Wulff <ow...@talend.com>.
Hi Julius
If you terminate the http session you are logged out of the web application. If you access the web application again, the container notices this is an unauthenticated request and triggers a redirect to the IDP.
If your browser still has got a valid session with the IDP it will just create a new token for the web application without challenging the user to authenticate as you expect from SSO.
WS-Federation defines the single log out use case which means that you log out in the IDP and he will log out all existing sessions with *all* web applications. The session between the IDP and the browser is terminated as well. Next time you access a web application, the IDP will challenge you again.
If an application requires to re-authenticate a browser user or requires a "fresh" token, an application can express this requirement by adding the wfresh parameter as part of the signin request. See section 13.2.2 in [1].
>>>
wfresh
This OPTIONAL parameter indicates the freshness requirements. If specified, this indicates the desired maximum age of authentication specified in minutes. An IP/STS SHOULD NOT issue a token with a longer lifetime. If specified as “0” it indicates a request for the IP/STS to re-prompt the user for authentication before issuing the token. Note that this serves roughly the same purpose as the Freshness element in the WS-Trust SOAP RST messages.
>>>
Fediz doesn't support this parameter yet. It requires an enhancement for the fediz plugin as well as the fediz idp. Feel free to raise a JIRA request thus this requirement can be tracked.
Thanks
Oli
[1] http://docs.oasis-open.org/wsfed/federation/v1.2/os/ws-federation-1.2-spec-os.html
------
Oliver Wulff
Blog: http://owulff.blogspot.com
Solution Architect
http://coders.talend.com
Talend Application Integration Division http://www.talend.com
________________________________________
From: Julius Francis [julius.francis@zurich.com]
Sent: 11 September 2012 09:40
To: users@cxf.apache.org
Subject: Logout from Fediz from single web application.
Hi All,
We are using Fediz in our web application . Would like to know
what we need to do to logout from web application . If we call
HttpSession.invalidate() , fediz takes controls and redirects to IDP where
the session is still active . Also I do understand the session is
created at tomcal level , how to we invalidate from application . Please
share if someone has already done.
What we want is that when user clicks on logout link , he should be
redirected to login page . How to tell IDP to redirect to login page
?(which means how to kill already existing session).
Thanks and Regards,
__________________________________________
Julius Francis
******************* PLEASE NOTE *******************
This message, along with any attachments, may be confidential or legally
privileged. It is intended only for the named person(s), who is/are the
only authorized recipients. If this message has reached you in error,
kindly destroy it without review and notify the sender immediately. Thank
you for your help.