0

I have a problem with Bonita that I've tried to work around without success. I am authenticating with CAS into Bonita, Alfresco and Liferay; the first time I am authenticating with CAS everything works fine, but when I logout from Liferay (which should then logout automatically from CAS), the current Bonita session is not terminated. The next time I login with CAS the Liferay and Alfresco sessions are correct (they belong to the new user), but the Bonita session doesn't change (the old user is still connected). Did anyone encounter this issue, and if yes, what could be a possible correction for this?

Any insight regarding the matter would be very appreciated, thanks!

Olaf Kock
  • 46,930
  • 8
  • 59
  • 90
user3419702
  • 3
  • 1
  • 2
  • Please check if you find information about Single Sign Out on https://wiki.jasig.org/display/casum/single+sign+out. This is rather an issue between Bonita and CAS than anything else. CAS provides the feature to log you out of every system that you authenticated to - if that system supports it. – Olaf Kock Mar 16 '14 at 08:56
  • Thanks a lot for the quick response! I will check the link to see if I can find out more information about this. – user3419702 Mar 16 '14 at 21:21

1 Answers1

0

I have managed to do this after a couple of difficult attempts to understand what the problem is. Apparently, there was a problem with the session cookie created by Bonita: the cookie JSESSIONID with the path "/bonita" was not destroyed when CAS destroyed its session and somehow its presence stopped it from being recreated. I have changed the Bonita cookie name to be different than JSESSIONID, because there were other cookies with that name in the browser and I changed the path of the cookie from "/bonita" to "/" in the file context.xml of Bonita. Then I have added javascript code to eliminate this cookie each time the theme of Liferay was reloaded (on page refresh), thus ensuring that the old cookie was destroyed. Every time after, when the Bonita url is visited the updated cookie is recreated from the new CAS session and everything seems to work fine. A better approach would be to destroy the cookie in the CAS logout jsp page, but I didn't manage to do it like this.

user3419702
  • 3
  • 1
  • 2