如何从 PingFederate 中的无 cookie 应用程序进行 SLO
我正在尝试使用 PingFederate 进行 SLO。 SP 应用程序之一配置为使用无 cookie 会话。 PingFederate 中的此 SP 应用程序设置了注销 URL,例如“http://site/logout.aspx”,但是当触发 SLO 流程时,PingFederate 成功将浏览器重定向到此 URL,但重定向到完全不同的会话比第一次创建 SSO 时生成的那个要多。如何配置 PingFederate 以重用在 SSO 过程中创建的会话重定向到 SP 的注销页面?
编辑:很抱歉我忘了提及一些事情。实际上,IdP 和 SP 应用程序都是在 ASP.NET 中开发的,通过 cookieless,我的意思是 SP 应用程序在其 web.config 文件中具有以下会话状态配置
<sessionState mode="InProc" cookieless="UseUri" regenerateExpiredSessionId="true" timeout="60" stateNetworkTimeout="30" />
此 sessionState 配置使 url 看起来像“http://site( S(pvvofbemnrmaixo2emaaeo0t))/Home.aspx',这对于 SSO 来说是可以的,因为当调用 'http://site/Home.aspx' 时,会创建一个新会话,因此替换url 包含“(S(blahblah))”,但是,当 SLO 进程调用 SP 的注销 url (http://site/logout.aspx) 时,会生成 SP 站点的新会话(与最初由 SSO 创建的)。因此,原始SP站点会话没有结束。
I'm trying to SLO using PingFederate. One of the SP apps is configured to use cookieless session. This SP app in PingFederate is set with the logout URL as being for example 'http://site/logout.aspx', but when the SLO process is triggered, PingFederate successfully redirects the browser to this url, however to a totally different session than the one spawned when the SSO was first made. How do I configure PingFederate to redirect to the SP's logout page reusing the session created in the SSO process?
Edit: I'm sorry I forgot to mention somethings. Actually both the IdP and SP applications are developed in ASP.NET, and by cookieless I mean that the SP application has in its web.config file the following session state configuration
<sessionState mode="InProc" cookieless="UseUri" regenerateExpiredSessionId="true" timeout="60" stateNetworkTimeout="30" />
This sessionState configuration makes the url look like 'http://site(S(pvvofbemnrmaixo2emaaeo0t))/Home.aspx', and this is ok for the SSO as when 'http://site/Home.aspx' is called, a new session is created, therefore replacing the url to include "(S(blahblah))", however, when the SP's logout url (http://site/logout.aspx) is called by the SLO process, a new session for the SP site is generated (different from the one originally created by the SSO). Consequently, the original SP site session is not ended.
如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。

当您说“配置为使用无 cookie 会话”时,您的意思是应用程序本身不使用 cookie 来维护状态吗?如果是这样的话,会话是如何维护的——通过 URL 重写?
我假设您通过 Ping Identity 集成套件(例如:开放令牌集成)登录应用程序。在 Java Integration Kit(例如)中,提供了以下示例代码来在 SP 集成应用程序中执行 SLO:
它确实依赖于 J2EE 应用程序中的会话管理。如果它是应用程序的新入口点(就像它可能是 SLO、IdP 发起的那样),那么您可能需要 cookie 来维护该状态信息。
在您的 SP 应用程序集成代码中是否不可能将一些会话信息存储在 cookie 中,以便稍后可以使其失效?否则实现 SLO 是相当困难的。这与其说是一个 PingFederate 问题,不如说是一个关于当用户直接访问应用程序并且他们已经登录时如何维护应用程序中的用户状态的问题。
When you say "configured to use cookieless session" - do you mean the application itself doesn't use cookies to maintain state? If that is the case, how is the session maintained - through URL re-writing?
I assume you are logging into the application via a Ping Identity integration kit (e.g.: Open Token integration). In the Java Integration Kit (for example), the following sample code is provided to do SLO at an SP integrated application:
which indeed relies on the session management within a J2EE application. If it's a new entry point into the app (like it would potentially be for SLO, IdP initiated) - then you would probably need cookies to maintain that state information.
Is it not possible in your SP application integration code to store some session info in a cookie, so you can later invalidate it? Otherwise it's rather tricky to achieve SLO. This isn't so much a PingFederate question, as it is a question on how you maintain user state in your application when a user accesses it directly and they are already logged in.