Uploaded image for project: 'DSpace'
  1. DSpace
  2. DS-4464

Shibboleth Single Logout (SLO) support

    XMLWordPrintable

    Details

    • Type: New Feature
    • Status: Code Review Needed (View Workflow)
    • Priority: Minor
    • Resolution: Unresolved
    • Fix Version/s: None
    • Component/s: REST API v7
    • Labels:
      None
    • Attachments:
      1
    • Comments:
      2
    • Documentation Status:
      Needed

      Description

      The DSpace 6 and lower implementations don't support CAS Logout (or Single LogOut). We use a national identification service, that also integrates with a government id service, and upon logout, all sessions should be terminated (across all service providers).

      As referred in https://github.com/DSpace/DSpace/pull/2651#issuecomment-585816548 there is this need. In the PR there are also some relevant comments from Ben Bosman and Mark H. Wood of how this feature could be working. Mark, if I understood correctly, proposes two different sign outs, one locally and the other CAS specific. And Ben somehow proposes the same, by having the presence of a specific configuration to control if CAS logout is enabled or not.

       

      This is what we (RCAAP from FCT|FCCN) did to have it working on DSpace repositories:

      Basically, in terms of the Service Provider, we use the shibboleth's notify parameter to configure the IdP logout url:
      https://wiki.shibboleth.net/confluence/display/SP3/Notify

      <Notify Channel="front" Location="https://[MY-SERVER]/logout" />

      When the logout event in DSpace is performed, then the Notify is triggered.
      Some exchanges will occur between the SP and the IdP and an indication to IdP to clean the shibboleth authentication will also occur.

      In our case we will have something like this: [https://[MY-SERVER]/shibboleth.sso/Logout?notifying=1&index=1|https://[my-server]/shibboleth.sso/Logout?notifying=1&index=1]

      To invoke the logout. We also clean local cookies too.

        Attachments

          Activity

            People

            Assignee:
            paulo_graca Paulo Graça
            Reporter:
            paulo_graca Paulo Graça
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

              Dates

              Created:
              Updated:

                Zendesk Support