Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

Administrative logout features

Description

Would be nice to have a generic way of invalidating a session ID (no matter what the storage engine is, cookies, localstorage, memcached or so).

E.g. when people get phished and the adversary logs in to the IDP with their credentials they are still able to use them even after the password has been changed.

Originating thread: http://thread.gmane.org/gmane.comp.web.shibboleth.user/48307

Environment

None
100% Done
Type
Key
Summary
Priority
Story Points
Assignee
Status

Confluence content

mentioned on

Activity

Show:

Scott CantorAugust 5, 2022 at 5:05 PM

Fixed duration handling to make better use of default property.

Scott CantorAugust 4, 2022 at 7:23 PM

Docs added. Reviewing for any missing bits.

Scott CantorAugust 3, 2022 at 7:54 PM

Decided to add an admin flow to make calls easier.

Documentation TBD and that should be it.

Scott CantorAugust 2, 2022 at 6:28 PM

Debating whether to actually build a dedicated admin flow to insert or delete revocation records, but I’m inclined to maybe just use the existing storage management flow and supply the right settings to call it in a script and in documentation. Less code seems better to me.

Scott CantorJuly 18, 2022 at 4:15 PM

Scheduling this for 4.3 for now while I start to work on design, we’ll see how far I get without breaking changes.

Done

Details

Assignee

Reporter

Components

Fix versions

Created May 27, 2016 at 10:16 AM
Updated January 18, 2023 at 1:29 PM
Resolved August 5, 2022 at 5:07 PM

Flag notifications