Spring Security OAuth2 doesn't kill the session and display login again

3
votes

I am following this tutorial about Spring-Security-Oauth2 :

https://github.com/spring-guides/tut-spring-boot-oauth2/tree/master/logout

The problem that I am facing is, when I clicked the logout button this send a post request to the /logout endpoint to kill to session, but when I clicked the LogIn button again I expect to see the login Form Again. But It seems that when /logout is called, this is in somewhere saving the information of the last logged user and always re-login again and does not display the login form.

I don't know how to kill the session in the SSO, I am using the same facebook OAuth.

Thanks for help.

1
javaspring-securityspring-bootsingle-sign-onspring-security-oauth2
Are you trying to get the Facebook login form back? Facebook will keep your session stored in their cookies and you have no control over or access to those. You can sign out of Facebook to see the login form again. - David V
Thanks for reply. Well I am using my custom SSO Provider From Pivotal Cloud Foundry, I have changed the facebook settings. But it doesn't work also with this. But, when I close the web browser and open it again, it works and display my sso login page, but I don't want my users to close their browsers to relogin with another credentials. - Erikson Murrugarra
Do you have a custom sign-on page (e.g. is says sign in with Google, Facebook, etc.)? And if so, is that what is not showing up after logging out? Or, is the problem with the Facebook login not appearing? I'm trying to better understand the problem you are having. - David V
Yes I have another SSO page a Pivotal Cloud foundry SSO Service, I have configured my credentials to point to my custom SSO. after logging out this SSO page is not showing up. Also the same happens with facebook. - Erikson Murrugarra
You might need http.logout().deleteCookies("JSESSIONID", "ANY_OTHER_COOKIE") in your Spring Security configuration. You can use your browser to find the cookies which your service is saving to your browser. - David V

1 Answers

0
votes

Dave Syer has described the behaviour that you indicate as the "notoriously tricky problem" when using authentication providers as Facebook:

“I want ‘logout’ to log me out” sounds simple enough, but the obvious response is, “Logged out of what? Do you want to be logged out of all the systems controlled by this SSO server, or just the one that you clicked the ‘logout’ link in?”

If you need to control the login/logout flow of your application using OAuth2, I would recomend implementing your own authorization server. There are 3 approaches: in memory, jdbc and jwt. I have posted a sample app using the first approach on github. Check it out and let me know if it helps you.