0

I am new to WIF. And now I encountered a problem when performing single sign off.

The following is the background of my problem: First of all, I am working on two old application A and B, which they stores the user's information in their own session variable after authenticating a user. And App A and B have their own local database. Now, my work is to use ADFS to enable SSO (Single Sign On) between two applications.

Now, I create a new active directory to store the users centrally. When a user try to login application A through ADFS, application A need to check the user name in the claim is exist in the local database. If exists, the user can login to App A. Otherwise, App A will reject the claim.

Here is the technical part:

I extend the WSFederationAuthenticationModule and check the incoming claim with the local database in the method OnSessionSecurityTokenCreated. If the result is matched, I retrieve the user information from local database and store it in the session variable (so that i can minimized the code change). App B uses the same approach.

I am happy with the SSO from here. But the problem come when i perform single sign off:

When I logout from App A, i first clean up the own session in App A and call the WSFederationAuthenticationModule.FederatedSignOut method. However, App B do not clean up its own session. I suppose the OnSignedOut in WSFederationAuthenticationModule will be invoked. How can i clean up the App B's session when App A is signed out?

It may be very confusing. Please leave any comments if you find something unclear or need further explanation.

KenLai
  • 251
  • 1
  • 4
  • 15

1 Answers1

0

Signout in WS-Fed is implemented by ADFS (it asks for a gif with app/?wa=wsignoutcleanup1.0), not only locally. That is the only way to notify the other app. Your app has to to redirect to ADFS with a signouturl. Then both apps will be notified and can cleanup their session state (with the gif request).

paullem
  • 1,261
  • 7
  • 8
  • May I know which method will be invoked in App so that i can cleanup their own session state? – KenLai Nov 05 '14 at 01:59
  • There are several events. WSFederationAuthenticationModule: SigningOut, SignedOut and SignedOutError. SessionAuthenticationModule: has the same events. There are two sets of signin and signout methods, those who do and do not fire the events. It is very flexible. Take a look at the books by Vittorio Bertocci and the .NET 4.5 documentation. – paullem Nov 06 '14 at 10:57