-
Bug
-
Resolution: Done
-
Critical
-
7.0.0.ER7, 7.1.0.DR5
-
None
Single Logout (Global Logout, GLO) does not fully work on distributable PicketLink IdP under certain circumstances – in case user uses (or is forced to use) different nodes with IdP for logging in and/or logging out to/from SPs (e.g. no sticky sessions, or a node failure), user can remain logged in at several service providers.
The issue may cause instability to a PL deployment where IdPs are distributed across different nodes/instances.
SAML2LogOutHandler uses IdentityServer structure stored in ServletContext – IdentityServer is not replicated/shared between instances. Thus, the list of participants is limited to the IdP where the logout was sent to.
- clones
-
JBEAP-3997 (7.0.z) Single Logout does not fully work on distributed PicketLink Identity Provider
- Verified
- is incorporated by
-
JBEAP-8845 [GSS](7.1.0) Upgrade picketlink 2.5.5.SP5 to 2.5.5.SP6
- Closed