SSO re-login failure when global logout is disabled

[Mike Rylander]

Evergreen version: 3.9+ (probably 3.7+, but not reported)

When using Shibboleth for SSO, and global logout is disabled, logging in after logout on the same computer can fail with a 404-Not Found. The problem is that we need to ignore our local "don't trust Shibboleth login" cookie in this situation.

This change also means we need to delegate SP logout, in addition to possible IdP and/or global logout, to the Shibboleth configuration. Therefore we always redirect to the Shibboleth logout service on Evergreen logout (when Shibboleth SSO is enabled), and SP, IdP, and global logout is configured and mediated by the Shibboleth and IdP configuration.

See https://shibboleth.atlassian.net/wiki/spaces/SHIB2/pages/2577072384/NativeSPLogoutInitiator for information on the Shibboleth configuration required for your local needs.

Branch forthcoming...

[Mike Rylander (mrylander)]

Fix available at the top of https://git.evergreen-ils.org/?p=working/Evergreen.git;a=shortlog;h=refs/heads/user/miker/lp-1989209-sso-logout-fix

[Jason Boyer (jboyer)]

Tested with and without timeout and with and without IdP logout enabled, works for me!

Signoff is here: https://git.evergreen-ils.org/?p=working/Evergreen.git;a=shortlog;h=refs/heads/user/jboyer/lp1989209-sso-signout-signoff / working/user/jboyer/lp1989209-sso-signout-signoff

[Galen Charlton (gmc)]

Pushed to master and rel_3_9. Thanks, Mike and Jason!

[Galen Charlton (gmc)]

Also pushed to rel_3_8.