SSO session refresh won't reset WWSympa's session

[ikedas]

Version

Confirmed with:

• IdP: OpenAM 13.0
• SP: Shibboleth-SP (Shibboleth 3.0.3)
• Sympa: 6.2.40

Installation method

RPM (Sympa-JA.org)

Expected behavior

If SSO session was refreshed, (for example, timeout occurred on the side of IdP, and then the user signed on again), session of Sympa would be reset.

Actual behavior

Following error is shown

ERROR (sso_login) You are already logged in as [email]

and Sympa session of previous user is kept.

Background

Current documentation describes a sort of "lazy session initiation", i.e. Sympa will trigger sign-on (See instruction in current documentation).

We want to implement "portal-style" "active" flow, i.e. when an unauthorized user tried to access any location under /sympa, they would be redirected to the login form served by IdP. For example ---

In httpd configuration:

...

<Location /sympa>                                                     ★Whole Sympa site protected
    AuthType shibboleth
    ShibRequestSetting requireSession 1
    require shib-session
</Location>

In shibboleth2.xml:

...

<SSO entityID="[entity ID of IdP]"
 target="https://[Sympa host]/sympa/sso_login/[Service name]/init">  ★Sign-on lets Sympa create session
  SAML2 SAML1
</SSO>
...

We don't need the button such as "SSO Login" on Sympa's user interface (we removed it by customizing web templates). Instead, we would like to reset Sympa's session as IdP needs.

---

Edit: Notes in config.