CAS logout and cookies elimination

java single-sign-on cas jasig
Steve McQueen picture Steve McQueen · Feb 24, 2012 · Viewed 11.7k times · Source

I just made a HelloWorld servlet and implemented CAS on it. I'm being able to log in without problem and CAS is setting 3 cookies in my browser, the CASGT, and 2 JSESSIONID 1 for /cas and another for /helloWorld

The problem is that then I access https://blah:8443/cas/logout, I see the logged out succesfuly screen but the cookies still are in my browser, so I'm not being loged out, I can get in again in /helloWorld without the login screen showing up.

Do you know what should I do for CAS to delete the cookies it created when I log out?

Thanks in advance

Answer

Infeligo picture Infeligo · Feb 24, 2012

CASGT cookie is set by CAS and should be unset by it. CAS logout procedure works like this:

  1. You actually go to CAS logout page. The page should know the application which you are logging out from. One way is to redirect to CAS logout page from your application, supplying the redirect-back URL as a parameter.

  2. Your cookie is erased and you are then redirected to your application via POST request.

  3. SingleSignOutFilter catches a special parameter "logoutRequest" and actually destroys the ticket/session mapping that it held from the very beginning and also invalidates current session.

In order to debug CAS, enable TRACE level logging. This way you will know if proper request was received or if session has been invalidated.

I also advice you to look at the code of org.jasig.cas.client.session package, which is quite simple.

Related questions

Implement SSO using CAS + Spring Security

I'm trying to implement SSO across several web applications using CAS and Spring Security. Expected case: CAS - http:// localhost:8080/cas/ App A protected content - http: //localhost:8081/cas-client1/secure/index.html App B protected content - http: //localhost:8081/cas-client2/…

Read More
CAS Single logout not working

I am implementing Single-Sign-On + Single-Log-Out in a Java EE environment through CAS. On the authentication side I have the cas-server-webapp v4.0.1. Then 2 simple Java + Spring MVC web apps with the cas-client-corev3.1.10. No issues regarding single sign on. If I access /…

Read More
Simple SSO - using custom authentication - CAS or some Oauth or openid server?

I'd like to know more about the different ways of solving Single Sign-On and their pros and cons. Have you worked with one particular solution, tell me what's good about it and tell me what the limitations or suboptimal parts …

Read More