Implementing logout. Single Sing Off

Question

Hi I have developed an application using SSO.
These are the steps I followed:
1.     In the Orion-application.xml:
<jazn provider="LDAP" location="ldap://hn-apli-dev.bcie.org:389" default-realm="jazn.com">
<jazn-web-app auth-method="SSO"/>
</jazn>
2.     In the web.xml
…….
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>jazn.com</realm-name>
</login-config>
…….
<security-constraint>
<web-resource-collection>
<web-resource-name>appName</web-resource-name>
<url-pattern>/</url-pattern>
</web-resource-collection>
<auth-constraint>
…….
The login works OK but I can’t implement the Single Sing Off .
I tried using this code
// Set the return URL
response.setHeader("Osso-Return-Url", "http://my.oracle.com" );
// Send Dynamic Directive for logout
response.sendError(470, "Oracle SSO");
But it works just for applications defined as Partner Applications.
What else should I do?

Answer 1

Seems like you are using mod_osso for enabling Single Sign-On to your applications. In this case, you do not have to register individual applications to the Single Sign-On server as a partner applications. Mod_osso registration should be sufficient and login/logout will work fine.
However, if you are creating application session and using that to show application content then logout will not work correctly. This is because single sign-off will not remove those JSESSION cookies (since they are application specific). To ensure that these application sessions can not be reused when user logs out, implement the application security logic as documented developer's guide.
Oracle® Identity Management Application Developer's Guide
10g Release 2 (10.1.2) Part No. B14087-01
Section 7.4 Security Issues: Single Sign-Off and
Application Logout