Infrastructure

André Littoz wrote:

I disconnected from the Discourse session by using the menu command associated with "avatar" at top right of screen (labeled Log Out). I was effectively disconnected but some token (cookie?) remained on my computer.

Next time I logged in, I did not need to enter manually my credentials as the token was automatically used (even if my computer was rebooted to make sure I started afresh).

Oh! Didn't understand what you were saying earlier. The SSO system (and all our other services) should definitely expire sessions when the browser closes (ie not set an expiration date on the cookie). If it works otherwise I definitely need to investigate why. Thanks for the report!

This has security implication for me: anybody able to log into my computer account can then log into my Discourse (or SSO) account without the need to validate credentials. This is not really important for my desktop, but may be serious for my laptop which is sometimes left unattended in meeting rooms.

While not an excuse for us apparently keeping sessions active across browser restarts, protecting a machine unlocked and unattended is pretty much impossible IMHO.

Guilhem Moulin provided me a link to fully disconnect from SSO, but this is inconvenient (I'll try to put it in a bookmark to have it at hand).

FWIW you can also find it in the dropdown menu at https://auth.documentfoundation.org .

Is is possible to have a second menu command with another label (making clear it will cause a full and complete disconnection) for this purpose?

Quoting what I wrote on Discourse for posterity:

In your scenario, where you’re using TDF Single Sign-On platform for a single service (namely Discourse at the moment), I agree [making Discourse logout terminate the SSO session is more secure]. However I’m not convinced this is desired for those of us who are using multiple services. Logging out from SSO currently does not terminate sessions in services: if logging out from Discourse/Gerrit/whatever were to log out from SSO, one might incorrectly believe that active sessions from other services are terminated while this is not the case (log in to gerrit and discourse, then log out from discourse and SSO — your session on gerrit remains active so anyone with access to your browser can review patches on your behalf). It’d make sense to push logout from SSO to all active sessions, but AFAICT this would require changing the authentication protocol and/or patching.

Having two logout buttons would just create confusion IMHO. And for the reason spelled above forcing logout from SSO is desired but isn't too useful if doesn't terminate active sessions on other services. I think we should thrive to have a single button that does terminate active sessions.

Guilhem Moulin wrote:

André Littoz wrote:

I disconnected from the Discourse session by using the menu command associated with "avatar" at top right of screen (labeled Log Out). I was effectively disconnected but some token (cookie?) remained on my computer.

Next time I logged in, I did not need to enter manually my credentials as the token was automatically used (even if my computer was rebooted to make sure I started afresh).

Oh! Didn't understand what you were saying earlier. The SSO system (and all our other services) should definitely expire sessions when the browser closes (ie not set an expiration date on the cookie). If it works otherwise I definitely need to investigate why. Thanks for the report!

So there are two issues in the present ticket. Moved the above to its own ticket #3342 and re-titling #3341 accordingly.

The Subject is not a typo, please don't change it back; what appears to be desired here is to have a single system to sign out from all services.

Guilhem Moulin wrote in #note-6:

I see now that Discourse has a SAML2.0 plugin, probably something to try out.

Did that now, that should partly solve the issue as far as Discourse is concerned. Clicking the logout button on Discourse now triggers a logout event on the authentication platform too, which solves the problem you describe in this ticket: One needs to authenticate again when clicking login.

”Partly” because there is a bug in our SAML Identity Provider (IdP); it was fixed upstream but we haven't upgraded yet. What's not working yet are IdP-issued SLOs that is, logout broadcast to other Service Providers (SP). If you're logged in to Nextcloud, Discourse, and the authentication plaftorm, then clicking logout on either of these should ideally log you out of all of these (and any other SP using SAML 2.0).

Keeping the ticket open for now. We'll probably upgrade some time in fall which should fix this in full (and also #3434).

Should be fixed now.