Logout from FOLIO, keep SSO login
Description
CSP Request Details
CSP Rejection Details
Potential Workaround
Attachments
- 10 May 2021, 09:52 AM
- 10 May 2021, 09:52 AM
clones
Checklist
hideTestRail: Results
Activity
Julian LadischJuly 19, 2021 at 10:22 PM
@Brooks Travis This issue has been closed. Please create a new "Story" issue for each of your feature requests; you may link https://folio-org.atlassian.net/browse/STCOR-532#icft=STCOR-532 as "relates to" in the issue links section.
Brooks TravisJuly 19, 2021 at 6:35 PMEdited
Oy. I would have just gone with "Log out of FOLIO". I'm not sure that including the "Keep SSO Login" part is actually that useful from a UX perspective. "Log out of FOLIO" is exactly what's happening, and the SSO login piece is actually only a problem for a limited time, which is why we tell all of our people to use Incognito mode to access FOLIO. What we really need to do is support SSO logout (optional) and make the token lifetime from SSO configurable and force re-authentication. That way, we can set it to a really short timeout and then require the user to log in to SSO again if they just log out of FOLIO. Right now, we either get the behavior described above or a very unhelpful 500 error if it's been too long and FOLIO will no longer accept the token provided by the SSO server.
Oleksiy_LemeshkoMay 24, 2021 at 5:35 AM
Dear Mr. Burke (@Zak Burke). Kindly populate "Story points" field of this ticket with reasonable value. Many thanks!
Julian LadischMay 15, 2021 at 8:48 PM
Works for me on https://folio-testing.dev.folio.org/ and https://folio-snapshot.dev.folio.org/ .
Thanks!
Zak BurkeMay 14, 2021 at 7:38 PM
@Craig McNally, @Mike Gorrell, @Khalilah Gambrell, the PR for this work has been merged. When logged in via SSO, the "Log out" button will instead read "Log out from FOLIO, keep SSO session".
SSO can be configured in any reference env to test this (though please don't link your SSO account to diku_admin
; see https://folio-org.atlassian.net/browse/UIU-2075#icft=UIU-2075). I am also happy to configure SSO for you and provide the credentials; just LMK how you want to proceed.
Overview:
The "Log out" menu option should warn that the SSO SAML login is kept.
Steps to Reproduce:
Log into some FOLIO environment where SSO is configured, for example https://folio-demo.gbv.de/ using login
rick
and passwordpsych
and all default options (remember login, ask me again if information to be provided to this service changes)In FOLIO go to the top right user menu and click "Log out"
After logout the login page of the FOLIO instance opens.
Click "Login via SSO"
The SSO login is successful because the identity provider (IdP) knows that the SSO login hasn't expired.
Expected Results:
The log out menu entry warns that the SSO login is kept if the tenant has SSO enabled, for example:
Actual Results:
The log out menu entry wording is "Log out", the warning is missing.
Use case:
I want to switch the user account in FOLIO. For the first account I use SSO, for the secound account I use the traditional non-SSO username+password login. And I still want to keep my SSO session at the SSO IdP so that I don't need to enter my credentials again when I want to switch back to the first account in FOLIO or if I want to use some other campus app with SSO and the first account.
Additional Information:
This issue is about renaming the existing logout option from "Log out" to "Log out from FOLIO, keep SSO login" (feel free to suggest an even better wording) when the tenant has SSO enabled.
props.okapi.ssoEnabled
reports whether SSO is enabled. If false "Log out" is used, if true "Log out from FOLIO, keep SSO login" is used.Related: https://folio-org.atlassian.net/browse/MODLOGSAML-92#icft=MODLOGSAML-92 is the issue for adding a logout menu entry that logs out from both FOLIO and SSO ("Log out from FOLIO and SSO".
Interested parties:
Universidad de Zaragoza