1

I'm currently making tests with the CAS server 3.5.2 and I'm facing problems with the logout. My knowledge in these topics is limited and I don't manage to go further on that point.

I installed a CAS server and I've got 2 instances of the same java application that point to that CAS server (appologize if I don't use the adecuates terms). So, when I access to the protected resources of my client aplication, I'm redirected to the CAS login page, I check in my DB if credentials are ok and then I access the resource. Then, if I access to the same protected resource from the second instance of the client application I'm not redirected to login page. That's perfect.

The problem is situated in the logout. To do so, I first execute a session.invalidate() and access to the CAS logout page. It's ok because, from the application from which I logged out, I must login again to access the protected resources. On the other side, the second application remains connected and I can access the protected resources without login again. Well, I know that the session.invalidate() is local to the first application but I thought that CAS server would have "broadcasted" the desconnexion to the other application but no.

Is there somebody who can give me experience feedback for the single sing out topic ?

4

2 回答 2

1

首先确保在 CAS 属性文件中启用了 SSO,如果没有确保在客户端中启用了 SSO 侦听器。如果启用了它们,那么我的猜测是问题出在 LogoutManagerImpl.java 或 SamlCompliantLogoutMessageCreator.java 文件中。

CAS 中的 SSO 通过传输 SAML XML 消息通过反向通道执行。去年我遇到了 SSO 功能的问题,只是发现正在广播的 XML 消息有一个错误,导致它无法被解析。

于 2015-01-22T07:45:12.563 回答
0

最后我解决了...在web.xml中,过滤器的顺序很重要。单点退出过滤器必须放在开头。请参阅该部分https://wiki.jasig.org/display/CASC/CAS+Client+for+Java+3.1#CASClientforJava3.1-OrderofRequiredFilters

于 2015-02-11T13:44:12.267 回答