I'm doing a sample webapp project, use spring and saml on it. I did login part, so when I run this project ,its move direclty to my identity server and there I login on this server than go to the my project home page. But I couldnt do logout part. When I click my project logout button , logout page is coming but my seesion isn't lost. So if I want login again, this time project dont go the identity server login page. Because, actually according to my project, I dont logout on project. I want logout on identity server , so want to lost my session.
How can I do it?
Thank you so much for now,
Ezgi,
Only SAML2 supports Single Logout, but you may want to read this pages to understand couple issues before starting to implement it:
https://wiki.shibboleth.net/confluence/display/SHIB2/SLOIssues
Related
I created one of the spring application project (a simple login form). where I recently added "logout" functionality. I was wondering how to add a logout timer so the user will be logged out fo inactivity after a certain interval of time. I tried looking resource on stack overflow as well as spring documentation but couldn't find one. Please note that I am using ALL JAVA CONFIGURATION (NO XML bsaed configuration).
So far I have designed a simple login functionality, which works as desired but I am trying refactor the "logout functionality" so user won't have to click on logout functionality all the time. I am attaching link for my codebase, please review it.
project: https://drive.google.com/file/d/1K1yhxsrUWxJe6iaeEL_Pj2HJ9C41vYaT/view?usp=share_link
*Note
while importing my project from DRIVE, you will have to add tomcat server (v9.0) and add the path of the server in the project as well.
I am developing spring MVC application, in my project, i have login page where I can successfully log in, the problem is that if I open new tab and log in with different username it's logging in, means at a time in the same browser I am able to login in multiple users which I don't want ,I want my application to single user login per browser how to make it.
While rendering login page, you check authentication. If you are using Spring security, you can check for principal auth present or not. If auth is present render home page else render login page. I think this can solve your issue neatly.
I suppose that Spring Security session management is what you're looking for:
Spring Security is able to prevent a principal from concurrently
authenticating to the same application more than a specified number of
times. Many ISVs take advantage of this to enforce licensing, whilst
network administrators like this feature because it helps prevent
people from sharing login names. You can, for example, stop user
“Batman” from logging onto the web application from two different
sessions. You can either expire their previous login or you can report
an error when they try to log in again, preventing the second login.
For more information, read the following docs:
http://docs.spring.io/spring-security/site/docs/3.1.x/reference/session-mgmt.html
Control the Session with Spring Security
Sorry if this is a bit long. Got a requirement to integrate our application with client's main portal site. The portal is maintained with a SAML 2.0 SSO features and as such, we'll need to integrate our login using SAML 2.0 as well.
The integration is done via an iframe, i.e. on the main portal, an iframe with the url pointing to our application. When user is logged in and click on a menu link, he/she will be presented with the iframe page, with our session checking with their IDP to make sure they are valid users. If so, then our application will continue to load as per usual.
The issue is that we'll need to maintain our session on our servers, while they shall maintain the session on their app server. If the user stayed on our site for a while, the session on the client main portal will timeout. And when the user click on the main portal link, they will be required to log in again.
It is suggested that when the user tries to navigate to the main portal pages, it will call a service (for now assuming it's an IDP) on our end to check whether the user session is valid or not. If it is, then we need to return a SAML response to them to validate the user.
We're exploring setting up an IDP service at our end to facilitates this, but it seems to be overkill to me. Is there a way for an IDP to only provides check on a user's session? Or is there a better option for us to achieve this?
Things that could not be changed:
1. SSO language: SAML 2.0
2. Server: Weblogic 10+
3. HTTPS a must.
Appreciate any suggestion or feedback.
Thanks.
Based on the provided information, I assume your application runs on WebLogic 10+. If the remote server too uses WebLogic you might be able to just implement the SAML authentication between the WebLogic federation. This will simplify everything and you don't need to do complicated application customization.
If the remote site does implement SAML and not on WebLogic, you still should be able to implement SAML authentication through the WebLogic configuration. This is straightforward and can be done without much hassle.
However, please be reminded that WebLogic 10+ does not support SAML SSO logout. Therefore, this needs to be handled separately.
I'm currently implementing this library ember-simple-auth to manage authentication in the emberjs application (shopping cart) that I am currently building.
The difficulty that I encounter is that the library manages authentication rules after logging in very well but not before logging in.
So here is the scenario:
The application must talk to the backend server to retrieve a session token for every user. This is necessary so that the user can save their items temporarily in the server side using session data. Something that you would expect for a shopping cart.
Then when the user is ready to move forward the application will then display the login screen and the user can authenticate themselves to checkout their items.
However, I can't seems to figure out yet how to do this using simple-auth. If I create a custom authenticator that just fetches token id from the server, it will mark the session as authenticated and will not ask for login on the authenticatedRoute.
In general what I'm trying to do are:
Customer visit the website
The application fetches session token from the server
Customer clicks around and saves item into the shopping cart. The data is synced with the server using the session token
Customer ready to checkout and navigates to checkout page
The application intercepts the route and redirect the customer to login route, where the customer can login and resume checkout.
I hope the above information is clear enough. Any hints and help will be much appreciated. Thanks.
I would probably only use Ember Simple Auth from the point on where the user actually logs in. Before that instead of using a session token to identify the basket, I'd probably explicitly create a basket on the server side (POST /basket) and then add to that via a REST interface (PUT /baskets/:id/items or so). That way you're not sharing state between the client and the server and have a clear interface. You also don't need to "abuse" Ember Simple Auth which probably only leads to other problems later on. When the user logs in then, you simply assign the previously created basket to that user and go on.
I have developed a mobile application using asp.net mvc3,html5,jquerymobile. I am authenticating the user using the ADFS authentication. Using IPAD or IPhone once the user is authenticated he is able to perform a download functionality in order to download an application. Now once the download functionality is completed when the user again tries to navigate back to the application he is prompted with the login window once again.
I need to stop the user from again entering the login credentials once again. So I thought of caching the user credentials will be good idea.
Can anyone help me to know how can we cache the user credential details in this case in order to prevent the user from entering the login credentials once again.
Thanks & Regards,
Santosh Kumar Patro
You could use persistent cookies. When authenticating simply pass true as second argument to the FormsAuthentication.SetAuthCookie method. This will emit a cookie that will be stored on the client for the given timeout period that you specify in the <forms> of your web.config.