That is a perfectly valid use case. What you propose "might" work depending on the CAS version you are on, but if you are going through the effort of encrypting the cookie, you might as well do this sort of thing programmatically which is to essentially replicate what the management interface does, minus the interface. You'd have to write an extension to ask CAS to give you back all the TGTs, find the one you want and have CAS kill it, all of which is via interacting with the ticket registry API.
A while back, I was playing around with a prototype of a groovy console that would hook into the CAS application context, allowing you to programmatically query the CAS API and interact with it. It's been a while since I have done anything meaningful with it, but that might be able a viable path to what you plan to do if you are prepared to spend the time to figure it out: https://github.com/UniconLabs/cas-groovy-shell > -----Original Message----- > From: [email protected] [mailto:[email protected]] On Behalf Of Tom > Poage > Sent: Friday, January 15, 2016 9:29 AM > To: CAS Community <[email protected]> > Subject: Re: [cas-user] Hazelcast management console > > Let's say I can administratively obtain the TGT, encrypt it as in CAS 4.x, > and > send that as a cookie to the /cas/logout path. Regardless of what's cached > in > a client's browser elsewhere, would this invalidate the TGT? Seems it > might. > Then if the client revisits /cas/login, they'd forced to log in again. > > If that's not the case--ignoring the new session management interface for > the > moment--how might one accomplish invalidating a client session? I ask, > because e.g. we have utilities for locking compromised accounts. Being > able > to invalidate any corresponding CAS sessions would be a plus, especially > if it > can be coded (e.g. IIRC when using memcached, one could delete a TGT > entry through a command line-like interface). > > Tom. > > > On Jan 15, 2016, at 2:28 AM, Misagh Moayyed <[email protected]> > wrote: > > > > Yes, but that works against your browser. You cannot administratively > > kill > my SSO session via removing my cookies from my browser on my computer > with that command. Front-channel logout has to involve the user’s browser, > which is useless in admin mode. > > -- > You received this message because you are subscribed to the Google Groups > "CAS Community" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > Visit this group at > https://groups.google.com/a/apereo.org/group/cas-user/. -- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/.
