6

We are adding the ability for enterprises to configure login to our web application via external single-sign-on providers (initially via WS-FED, however, future versions will support additional protocols). Username/password authentication will also be available for customers that don't have/want to configure an external SSO provider, and also as a fall-back in cases where there is some problem with the SSO provider.

What should happen when users click the "Log out" button in our application?

  • They are logged out of our application only so that other applications that authenticate via the SSO provider are still available.
  • As above, but we additionally request re-authentication with the SSO provider.
  • They are completely logged out of their SSO provider
3

This is one of those places usability and security cause radically different answers.

From a usability standpoint I have observed the following arguments:

  • When I logout on Site a I only logout form here and I can keep on using the other locations I am still logged into.
  • When I press logout on Site a I actually only get redirected to Site b (the portal) and only when I log out form there I am actually logged out. (mostly used in the context of an intranet or similar environment)

From a security standpoint I have observed the following arguments:

  • When a user does a Logout, immediately invalidate ALL sessions for this user and log him/her/it out from any and all systems part of the SSO.
  • When a user does a logout, inform the SSO provider and do not allow any new sessions and logout of the current application. but there is no implicit logout to all systems in the SSO. (usually mitigated with short session times / cookie lifetimes). This can be a technical limitation due to the technologies involved (and/or licenses)
  • @NeilSmithline Thanks, I missed that when I did my re-read. – LvB Feb 29 '16 at 15:28
  • 1
    Given that SSO login is transparent and implicit when a user is logged in "other locations" what is the meaning of "I only logout from here and I can keep on using the other locations" ? I question the "I only logout from here" part. If, after a few minutes, the user were to visit with his browser the location he just logged out from (while still being logged into some other locations) then he would automatically and transparently log in again without noticing anything. In such a scenario what is the meaning of "I only logout from here" in terms of user experience ? – Marcus Junius Brutus Nov 27 '16 at 23:49
  • From a users standpoint t means the user feels like it can not trust the web applications. (a logout does not always mean I am logged out) I focus here on the security implications. and they are even worse than the user-experience. in the first example an attacker can obtain user access credentials (e.a. a session) when the user thinks he/she/it logged out. SSO is not an simple subject before you try and implement it learn and understand its implications. – LvB Dec 1 '16 at 9:36
1

In most SSO authentication system I've used, Log Out usually means to log out of the authentication provider and all connected systems.

In some poorly written applications and SSO system, the application may cache the authentication and may not notice that the session they're using have already expired, but the application are supposed to periodically recheck the session validity to prevent this situation from staying for long. Better SSO systems are able to post back to the applications, to force them to log out immediately rather than depending on the application check periodically.

  • Do you have any documentation for "the application are supposed to periodically recheck*? In what scenarios using what standards? – Neil Smithline Feb 29 '16 at 15:07
  • @NeilSmithline: I don't think there's a standard here. I've seen many different handling in the wild. While I say "periodically recheck", it's really implementation dependant how that's done, some applications may have short session time, others might do background runner, and some might just lazily revalidate on the next request from the user or depends on call back. No matter how the applications implement this, the goal is usually that single sign in implies single sign out. – Lie Ryan Feb 29 '16 at 15:19
1

There's probably no right answer here, but I'll advocate that "Log Out" only applies to your site.

Stack Exchange as an example

I use the "Sign in with Google" option. When I click Log Out, I see this:

The logout "menu" in stack exchange

Notes:

  1. It shows that I will be logged out of all Stack Exchange domains.
  2. It is my choice whether to only log me out of this device, or all devices. (which I assume is delete-local-browser-cache vs invalidate-serverside-session).
  3. After logging out of SE, my gmail tab continues to work.

Some reasons that I'm not comfortable with

They are completely logged out of their SSO provider

Usability

I'd be pretty annoyed if I log out of Stack Exchange on my laptop and some time later discover that my phone's been kicked out of my Google account, causing me to miss urgent emails, chats, have unsynced Google Docs, etc.

Security

If logging out of one service causes me to be logged out of the SSO provider, could that be considered a denial of service attack vector? ie can a rogue Stack Exchange employee get my browser to log me out of all Google services? Does it increase the impact of XSS vulnerabilities in the 3rd party sites? ie does this in any way link the security of two unrelated sites just because they use the same SSO provider? (I'd need to ponder on this some more)

  • +1 Good points, but ie can a rogue Stack Exchange employee call Log Out on my account? Nope, because logout requires the cookies for the SSO domain (e.g. Google), which are stored on your device and cannot be accessed by another domain, – Justin Sep 12 '18 at 16:22
  • I agree that they can't hijack your existing session with the SSO server, but what's stopping them from opening a new session? Basically, what's stopping an admin from writing a script that requests a login token from the SSO provider for your account, if you happen to be logged in using a different app then the script will be given a cookie, then it logs you out? (I'm probably missing some key piece of the SAML / OpenID Connect protocol) – Mike Ounsworth Sep 12 '18 at 16:59
0

Questions like this arise when there's confusion about the purpose of "Log out" button.

What is "Log out" for?

Some preconditions:

  • Usability-wise, if the user does not want to log out, they should simply not use this button.
  • If the website providing the log out button cannot be trusted, what logging out actually does is moot.
  • "Log out" should not be confused with "Switch account". Even though "Switch account" can be emulated by logging out and logging in again, the usability of this use-case should not be priority in the design of "Log out" button. Usability issues that arise due to the lack of a "Switch account" button is exactly due to that lack of, and is no fault of what the "Log out" button does.

What is "Log out" for?

When the browser is used in a physically shared PC, the user needs some way clearing their sessions so that another user who uses the same PC afterwards cannot also gain access to the same sessions.

Hence, the "Log out" should:

  1. Invalidate the session on the website used
  2. Sign out of the SSO provider

If the implementation of the "Log out" button omits the second bullet, other users can simply SSO back into the website using the still active SSO provider session.

Note: "Sign out of the SSO provider" does not mean immediately logging out of every websites logged in using the same SSO provider. Each website will have their own independent session, so some sites may be accessible well after signing out of the SSO provider. Logging out of every website logged in using the same SSO provider is beyond the scope of a single website's "Log out" button.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.