Uploaded image for project: 'Admincentral'
  1. Admincentral
  2. ADMINCTR-479

Logout from external IdPs no longer works (Magnolia 6.3)

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Major Major
    • 6.3.0
    • 6.2.33
    • None
    • Yes

      Since ADMINCTR-450, we invalidate the HttpSession too eagerly, thus killing other/external logout logic that happens downstream from VaadinSession destroy, such as SSOs' logout filter: we use Pac4j's SessionStore (info in the http-session) to track the web session and interaction with the IdP.

      Desired behavior:

      • let a Vaadin session timeout kill itself
      • if it's the last/only Vaadin session alive within the HTTP session, trigger http session expiry
      • but do that via redirect, not via session#invalidate (not to harm SSO's session-tracking)

        Acceptance criteria

              mgeljic Mikaël Geljić
              mgeljic Mikaël Geljić
              AdminX
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved:
                Work Started: