mahara-contributors team mailing list archive

[Robert Lyon <robertl@xxxxxxxxxxxxxxx>]

** Changed in: mahara
       Status: In Progress => Fix Committed

** Changed in: mahara/15.04
       Status: In Progress => Fix Committed

** Changed in: mahara/15.10
       Status: In Progress => Fix Committed

** Changed in: mahara/16.04
       Status: In Progress => Fix Committed

** Information type changed from Private Security to Public Security

-- 
You received this bug notification because you are a member of Mahara
Contributors, which is subscribed to Mahara.
Matching subscriptions: Subscription for all Mahara Contributors -- please ask on #mahara-dev or mahara.org forum before editing or unsubscribing it!
https://bugs.launchpad.net/bugs/1084336

Title:
  mnet: mahara doesn't implement kill_child which results in not being
  logged out when logged out from a remote IdP over mnet

Status in Mahara:
  Fix Committed
Status in Mahara 15.04 series:
  Fix Committed
Status in Mahara 15.10 series:
  Fix Committed
Status in Mahara 16.04 series:
  Fix Committed

Bug description:
  When Mahara is doing SSO via MNet, with a remote IdP, it ought to log
  you out of Mahara when you log out of the IdP. MNet allows for this
  via the "kill_child" API method, which the IdP will call for each
  connected service provider to tell it to log a user out.

  Mahara never implemented this method, so it doesn't log you out
  properly when you log out of the IdP.

  To replicate:

  1. Set up MNet between a Moodle & Mahara site, with Moodle as the identity provider (i.e. users log in to Moodle and then roam over to Mahara)
  2. Log in to Moodle
  3. Roam over to Mahara
  4. Open up Moodle in another tab.
  5. Log out of Moodle.
  6. Go back to the tab with Mahara and try to navigate around in the site.

  Expected result: You can't navigate around because you're logged out
  of Mahara

  Actual result: You are not logged out of Mahara

To manage notifications about this bug go to:
https://bugs.launchpad.net/mahara/+bug/1084336/+subscriptions