#9959 Still logged in after doing Log Out from src.fedoraproject.org
Closed: Will Not/Can Not fix 2 years ago by smooge. Opened 2 years ago by oturpe.

Describe what you would like us to do:

Log Out menu option does not perform log out in src.fedoraproject.org

To reproduce:
1. Log In to src.fedoraproject.org with Fedora Account
2. Select Log Out from the menu

Expected behavior:
1. Not being logged in any more

Actual behavior:
1. Notification about logging out is shown
2. But actually, still logged in

There is some quick sequence of redirects after Log Out, I think the browser is directed to login page and an automatic re-login happens there.

Original report for Pagure: https://pagure.io/pagure/issue/5139, has screenshot from @salmanishere where this happens on pagure.io, too.

When do you need this to be done by?

Not urgent in my use. Maybe more so for somebody who is accessing src.fedoraproject.org from a computer shared with other users.


Try loging out while on https://src.fedoraproject.org/browse/projects/ and you will see that it works.

The issue is as follow:

  • you are on a page that requires you to be logged in
  • you click on log out
  • you are logged out and are redirected to the page you came from
  • the page requires you to be logged in
  • you are redirected to the auth server which lets you authenticate because you have either a valid kerberos ticket or you logged in recently enough
  • you are back on the page you started from, authenticated, thus giving you the impression that you did not log out.

If you log out on a publicly accessible page (a project's page, one of the browsing pages), it works just fine.

I do not think there is anything to fix there, while it can be surprising this is just how it work due to/because of our SSO

Metadata Update from @smooge:
- Issue close_status updated to: Will Not/Can Not fix
- Issue status updated to: Closed (was: Open)

2 years ago

Thank you, I now understand what is happening.

Just a note, the case of publicly accessible page does not really work as expected: It looks like you are logged out, but as soon as you reach a page that requires log in, the redirect logs you in automatically. So you were not really logged out in any meaningful sense.

A possible improvement would be this: If the system is configured to use SSO (of this particular kind?), Log Out button would be greyed out and a tooltip would explain that Log Out is not supported with SSO. I understand that such change may get such a low priority that it never gets implemented, though.

We could also perhaps redirect to a logout page... but that may annoy some folks who wanted to logout to do something on the page they were on.
:(

Login to comment on this ticket.

Metadata