Jasig Cas ticket validation on client web application logout

197 Views Asked by At

My web application is integrated with a portal that use cas authentication. Logout is possible in two ways: on my web application (I first invalidate my session and then logout on portal page) or directly by portal (in this case session on my web application continues to exist - there are no single signout mechanisms implemented). In this last case there's a problem..if I logout on portal and then write directly URL of my web application the page is shown to me! So..I would like the validation of ticket for each request in order to understand that the ticket is no longer valid..but I don't know how I can do it. Can someone help me?

1

There are 1 best solutions below

0
On

If I logout on portal and then write directly URL of my web application the page is shown to me!

Yes, because as you noted there is no SLO. Just because you kill the portal session, it does not mean that your app session will be destroyed. The most ideal solution would be to implement SLO, such that the portal can reach out to registered applications and ask them to logout by sending them a logout notification. Then, in your app you just need to intercept that notification and kill the app session.