mnet: mahara doesn't implement kill_child which results in not being logged out when logged out from a remote IdP over mnet

[Hugh Davenport]

When Mahara is doing SSO via MNet, with a remote IdP, it ought to log you out of Mahara when you log out of the IdP. MNet allows for this via the "kill_child" API method, which the IdP will call for each connected service provider to tell it to log a user out.

Mahara never implemented this method, so it doesn't log you out properly when you log out of the IdP.

To replicate:

1. Set up MNet between a Moodle & Mahara site, with Moodle as the identity provider (i.e. users log in to Moodle and then roam over to Mahara)
2. Log in to Moodle
3. Roam over to Mahara
4. Open up Moodle in another tab.
5. Log out of Moodle.
6. Go back to the tab with Mahara and try to navigate around in the site.

Expected result: You can't navigate around because you're logged out of Mahara

Actual result: You are not logged out of Mahara

[Aaron Wells (u-aaronw)]

If we keep dragging our feet on this one, MNet replacement should solve the problem for us. ;)

[Aaron Wells (u-aaronw)]

I'm going to take a quick try at fixing this, using the information supplied on the two duplicate bug reports Bug #1084347 and Bug #1598664.

[Aaron Wells (u-aaronw)]

To replicate:

1. Set up MNet between a Moodle & Mahara site, with Moodle as the identity provider (i.e. users log in to Moodle and then roam over to Mahara)
2. Log in to Moodle
3. Roam over to Mahara
4. Open up Moodle in another tab.
5. Log out of Moodle.
6. Go back to the tab with Mahara and try to navigate around in the site.

Expected result: You can't navigate around because you're logged out of Mahara

Actual result: You are not logged out of Mahara

[Aaron Wells (u-aaronw)]

Security patch: https://reviews.mahara.org/6647

[Mahara Bot (dev-mahara)]

Reviewed: https://reviews.mahara.org/6647
Committed: https://git.mahara.org/mahara/mahara/commit/2837542d07b07e1e43fd1841166af0e7edd7cc0d
Submitter: Robert Lyon (<email address hidden>)
Branch: master

commit 2837542d07b07e1e43fd1841166af0e7edd7cc0d
Author: Aaron Wells <email address hidden>
Date: Tue Jul 5 12:19:42 2016 +1200

Bug 1084336: Implement MNet "kill child"

If you're logged in to Mahara via a remote IdP,
when you log out on the IdP it will try to invoke
this method to log you out of Mahara.

Change-Id: Ia11250b408ba594aaa179478cd67d5499cd1e2c8
behatnotneeded: Can't test Mnet in Behat yet

[Mahara Bot (dev-mahara)]

Reviewed: https://reviews.mahara.org/6698
Committed: https://git.mahara.org/mahara/mahara/commit/8654c56dcbe0cd325b9bea4ed914dc869c6ee949
Submitter: Robert Lyon (<email address hidden>)
Branch: 16.04_STABLE

commit 8654c56dcbe0cd325b9bea4ed914dc869c6ee949
Author: Aaron Wells <email address hidden>
Date: Tue Jul 5 12:19:42 2016 +1200

Bug 1084336: Implement MNet "kill child"

If you're logged in to Mahara via a remote IdP,
when you log out on the IdP it will try to invoke
this method to log you out of Mahara.

Change-Id: Ia11250b408ba594aaa179478cd67d5499cd1e2c8
behatnotneeded: Can't test Mnet in Behat yet

[Mahara Bot (dev-mahara)]

Reviewed: https://reviews.mahara.org/6699
Committed: https://git.mahara.org/mahara/mahara/commit/c6a72f8145a72d8d20955769c42325da6bffbb3e
Submitter: Robert Lyon (<email address hidden>)
Branch: 15.10_STABLE

commit c6a72f8145a72d8d20955769c42325da6bffbb3e
Author: Aaron Wells <email address hidden>
Date: Tue Jul 5 12:19:42 2016 +1200

Bug 1084336: Implement MNet "kill child"

If you're logged in to Mahara via a remote IdP,
when you log out on the IdP it will try to invoke
this method to log you out of Mahara.

Change-Id: Ia11250b408ba594aaa179478cd67d5499cd1e2c8
behatnotneeded: Can't test Mnet in Behat yet

[Mahara Bot (dev-mahara)]

Reviewed: https://reviews.mahara.org/6700
Committed: https://git.mahara.org/mahara/mahara/commit/4aab3a18cb0b261a4a8074e34b642f18fef91012
Submitter: Robert Lyon (<email address hidden>)
Branch: 15.04_STABLE

commit 4aab3a18cb0b261a4a8074e34b642f18fef91012
Author: Aaron Wells <email address hidden>
Date: Tue Jul 5 12:19:42 2016 +1200

Bug 1084336: Implement MNet "kill child"

If you're logged in to Mahara via a remote IdP,
when you log out on the IdP it will try to invoke
this method to log you out of Mahara.

Change-Id: Ia11250b408ba594aaa179478cd67d5499cd1e2c8
behatnotneeded: Can't test Mnet in Behat yet

[William (williamchan19)]

Dear Sir,

I upgrade Mahara 15.10.4
I also use both Moodle 2.9.x version and 3.1.1 to test this issue

However, same problem is happened and seems mahara isn't still logout after logout in moodle.

Regards,
                   William

[Aaron Wells (u-aaronw)]

Hi William,

I tested it just now with an installation of Moodle 3.1.1 and a Mahara instance on 15.10.4, and it worked as expected. Specifically, I followed the test case described here, and got the expected result: https://bugs.launchpad.net/mahara/+bug/1084336/comments/3

Can you confirm if that test case isn't working for you, or if you're talking about a different test case?

Cheers,
Aaron