Re: [cas-user] SLO within browser context

[Paul Roemer]

Guys,

thanks a lot for all your awesome answers. Switching to the front channel 
mechanism solved the issue for us. But I am happy about the possible 
fallbacks in case we have to switch back to the back channel.

Cheers,
 Paul

On Wednesday, June 17, 2020 at 6:29:46 PM UTC+2 pascal...@univ-paris1.fr 
wrote:

> Hi,
>
> In case you can't use front-channel SLO,
> when you use cookie affinity,
> here is a solution that duplicates the back-channel SLO request to all 
> the backends :
> https://github.com/EsupPortail/proxy-broadcast
>
> cu
>
>
> Paul Roemer  a écrit :
>
> > Hey guys,
> >
> > I just ran into the SLO + loadbalancer issue as some of our CAS clients 
> are
> > clustered. Now, I wonder if it is possible to send the POST logout 
> requests
> > to the services participating at the current SSO session from within the
> > browser/from client side instead of sending them from the CAS server.
> >
> > If that is possible, I expect the load balancer issue is solved without
> > further adjustments as it will redirect the request to the correct node 
> in
> > case of a clustered CAS client.
> >
> > What are your thougts?
> >
> > Cheers,
> > Paul
> >
> > --
> > - Website: https://apereo.github.io/cas
> > - Gitter Chatroom: https://gitter.im/apereo/cas
> > - List Guidelines: https://goo.gl/1VRrw7
> > - Contributions: https://goo.gl/mh7qDG
> > ---
> > You received this message because you are subscribed to the Google 
> > Groups "CAS Community" group.
> > To unsubscribe from this group and stop receiving emails from it, 
> > send an email to cas-user+u...@apereo.org.
> > To view this discussion on the web visit 
> > 
> https://groups.google.com/a/apereo.org/d/msgid/cas-user/95830dcf-aa6a-44df-8c7e-7d84d517f83an%40apereo.org
> .
>
>
>
> -- 
> Pascal Rigaux
>
>

-- 
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
--- 
You received this message because you are subscribed to the Google Groups "CAS 
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to cas-user+unsubscr...@apereo.org.
To view this discussion on the web visit 
https://groups.google.com/a/apereo.org/d/msgid/cas-user/2bd3ff07-d344-4f45-8718-cd2b8cfe7f6fn%40apereo.org.

Re: [cas-user] SLO within browser context

[Pascal Rigaux]

Hi,

In case you can't use front-channel SLO,
when you use cookie affinity,
here is a solution that duplicates the back-channel SLO request to all  
the backends :

https://github.com/EsupPortail/proxy-broadcast

cu


Paul Roemer  a écrit :


Hey guys,

I just ran into the SLO + loadbalancer issue as some of our CAS clients are
clustered. Now, I wonder if it is possible to send the POST logout requests
to the services participating at the current SSO session from within the
browser/from client side instead of sending them from the CAS server.

If that is possible, I expect the load balancer issue is solved without
further adjustments as it will redirect the request to the correct node in
case of a clustered CAS client.

What are your thougts?

Cheers,
  Paul

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google  
Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it,  
send an email to cas-user+unsubscr...@apereo.org.
To view this discussion on the web visit  
https://groups.google.com/a/apereo.org/d/msgid/cas-user/95830dcf-aa6a-44df-8c7e-7d84d517f83an%40apereo.org.




--
Pascal Rigaux

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
--- 
You received this message because you are subscribed to the Google Groups "CAS Community" group.

To unsubscribe from this group and stop receiving emails from it, send an email 
to cas-user+unsubscr...@apereo.org.
To view this discussion on the web visit 
https://groups.google.com/a/apereo.org/d/msgid/cas-user/20200617182928.Horde.Ly8CnNiQnM6PD1qL2dzmifH%40courrier.univ-paris1.fr.

Re: [cas-user] SLO within browser context

[Ray Bon]

Paul,

I think phpCas will do logout replication if it is configured with the ips of 
cluster members. Not sure about other clients.
In a 'true' clustered environment, the user sessions are shared among cluster 
members. Thus, any host receiving the logout request will propagate to other 
cluster members.

Ray

On Tue, 2020-06-16 at 22:21 -0700, Paul Roemer wrote:

Hey guys,

I just ran into the SLO + loadbalancer issue as some of our CAS clients are 
clustered. Now, I wonder if it is possible to send the POST logout requests to 
the services participating at the current SSO session from within the 
browser/from client side instead of sending them from the CAS server.

If that is possible, I expect the load balancer issue is solved without further 
adjustments as it will redirect the request to the correct node in case of a 
clustered CAS client.

What are your thougts?

Cheers,
  Paul

--

Ray Bon
Programmer Analyst
Development Services, University Systems
2507218831 | CLE 019 | r...@uvic.ca

I respectfully acknowledge that my place of work is located within the 
ancestral, traditional and unceded territory of the Songhees, Esquimalt and 
WSÁNEĆ Nations.

-- 
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
--- 
You received this message because you are subscribed to the Google Groups "CAS 
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to cas-user+unsubscr...@apereo.org.
To view this discussion on the web visit 
https://groups.google.com/a/apereo.org/d/msgid/cas-user/9afe02a69be0925bdca3ca676ef8caaa0cd808aa.camel%40uvic.ca.

Re: [cas-user] SLO within browser context

[Jérôme LELEU]

Hi,

Yes, you can. This is called "front channel". You can configure that at the
service level.
See:
https://apereo.github.io/cas/6.1.x/installation/Logout-Single-Signout.html#front-channel
Thanks.
Best regards,
Jérôme


Le mer. 17 juin 2020 à 07:22, Paul Roemer  a écrit :

>
> Hey guys,
>
> I just ran into the SLO + loadbalancer issue as some of our CAS clients
> are clustered. Now, I wonder if it is possible to send the POST logout
> requests to the services participating at the current SSO session from
> within the browser/from client side instead of sending them from the CAS
> server.
>
> If that is possible, I expect the load balancer issue is solved without
> further adjustments as it will redirect the request to the correct node in
> case of a clustered CAS client.
>
> What are your thougts?
>
> Cheers,
>   Paul
>
> --
> - Website: https://apereo.github.io/cas
> - Gitter Chatroom: https://gitter.im/apereo/cas
> - List Guidelines: https://goo.gl/1VRrw7
> - Contributions: https://goo.gl/mh7qDG
> ---
> You received this message because you are subscribed to the Google Groups
> "CAS Community" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to cas-user+unsubscr...@apereo.org.
> To view this discussion on the web visit
> https://groups.google.com/a/apereo.org/d/msgid/cas-user/95830dcf-aa6a-44df-8c7e-7d84d517f83an%40apereo.org
> 
> .
>

-- 
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
--- 
You received this message because you are subscribed to the Google Groups "CAS 
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to cas-user+unsubscr...@apereo.org.
To view this discussion on the web visit 
https://groups.google.com/a/apereo.org/d/msgid/cas-user/CAP279LzsM0qg5donJaN4yVkmf8_kFaxmeJh7UX3ChiE4aK0hpQ%40mail.gmail.com.

[cas-user] SLO within browser context

[Paul Roemer]

Hey guys,

I just ran into the SLO + loadbalancer issue as some of our CAS clients are 
clustered. Now, I wonder if it is possible to send the POST logout requests 
to the services participating at the current SSO session from within the 
browser/from client side instead of sending them from the CAS server.

If that is possible, I expect the load balancer issue is solved without 
further adjustments as it will redirect the request to the correct node in 
case of a clustered CAS client.

What are your thougts?

Cheers,
  Paul

-- 
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
--- 
You received this message because you are subscribed to the Google Groups "CAS 
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to cas-user+unsubscr...@apereo.org.
To view this discussion on the web visit 
https://groups.google.com/a/apereo.org/d/msgid/cas-user/95830dcf-aa6a-44df-8c7e-7d84d517f83an%40apereo.org.