[jboss-jira] [JBoss JIRA] (ELY-904) Logout notification support for HTTP-based authentication mechanisms

[Pedro Igor (JIRA)]

    [ https://issues.jboss.org/browse/ELY-904?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13358043#comment-13358043 ] 

Pedro Igor commented on ELY-904:
--------------------------------

[~darranl], another use case we should keep in mind is mechanisms that rely on cookies which can be removed during logout. Where logout may be triggered programmatically.

I've worked on a solution that works for SESSION based mechanisms using notifications. But for cookie-based mechanisms, programmatic logout doesn't work because we process the "responders" right after evaluating a request for during authentication. In this case, notifications can be triggered by the application (e.g.: a servlet + programmatic logout) after responders are processed, what makes impossible to notification listeners write to the response. 

> Logout notification support for HTTP-based authentication mechanisms
> --------------------------------------------------------------------
>
>                 Key: ELY-904
>                 URL: https://issues.jboss.org/browse/ELY-904
>             Project: WildFly Elytron
>          Issue Type: Enhancement
>          Components: HTTP
>    Affects Versions: 1.1.0.Beta21
>            Reporter: Pedro Igor
>            Assignee: Pedro Igor
>
> I think it makes sense to also allow HTTP mechanisms to handle logouts. Logout is tightly related with authentication and mechanisms should be able to act properly during logout requests.
> Although only a few set of mechanisms support logout, I think adding a default method  {{org.wildfly.security.http.HttpServerAuthenticationMechanism#logout}} will make our API even more complete and capable of supporting more use cases.
> The main use case for this enhancement is programmatic logout. In this case, logout can be triggered from inside an application which in turn delegates the logout logic to the mechanism that authenticated an user.
> Considering Elytron Web, this enhancement would make integration with other containers even more simple and avoid dealing with specific logout mechanisms (e.g.: notifications) provided by these same containers. This is specially true for servlet containers.



--
This message was sent by Atlassian JIRA
(v7.2.3#72005)