Let's say I can administratively obtain the TGT, encrypt it as in CAS 4.x, and send that as a cookie to the /cas/logout path. Regardless of what's cached in a client's browser elsewhere, would this invalidate the TGT? Seems it might. Then if the client revisits /cas/login, they'd forced to log in again.
If that's not the case--ignoring the new session management interface for the moment--how might one accomplish invalidating a client session? I ask, because e.g. we have utilities for locking compromised accounts. Being able to invalidate any corresponding CAS sessions would be a plus, especially if it can be coded (e.g. IIRC when using memcached, one could delete a TGT entry through a command line-like interface). Tom. > On Jan 15, 2016, at 2:28 AM, Misagh Moayyed <[email protected]> wrote: > > Yes, but that works against your browser. You cannot administratively kill my > SSO session via removing my cookies from my browser on my computer with that > command. Front-channel logout has to involve the user’s browser, which is > useless in admin mode. -- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/.
