1

I have been working on a project that integrates spring-cloud-based microservices and MVC applications with SSO. currently, I use spring-session for the session repository service. My current applications login component contains an authentication server to create a session in the backend, and a frontend client calling such a login service, it works fine. But when I logout from other applications, my current strategy is to redirect to the logout page of this login component and then send an ajax call to the backend service to set the session stored in the session repository to expire. This approach works only if the user is successfully redirected to the login component to logout.

I thought about calling the logout service directly from the other applications instead of redirecting all logout requests to the login component, but the downside would be for all my other applications, I need to implement the logout service.

What would be the general strategies to use to guarantee user session is logged out in an SSO environment that could minimize creating duplicated logout service for each application?

Improve this question

1 Answer 1

Reset to default
1

If I recall (and I am no expert in SSO/federation), in an SSO ecosystem the Identity Provider should have a list of 'session participants' (service providers participating in the current session).

Suppose there are three service providers (A, B, c) SSO'd for a given user. When that user logs out in A (sending a logout request to the IDP), the IDP should send a logout request to B and C (the other active service providers), who each need to invalidate the associated session, and return a logout response to the IDP.

When that's done, the IDP should send the logout response to A.

Working around that flow might cause issues in a federated authentication ecosystem where you do not control all the federated service providers.

Improve this answer
1
  • I found there is a term for this is called single sign off. Commented Oct 26, 2018 at 13:54

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.