Comment 6 for bug 451336

Revision history for this message
Matthew Nuzum (newz) wrote : Re: Need to redirect back to the consumer after logout

Hi, I appreciate the thoroughness of the specification. It's impressive to see the thought put into this.

Let's create three scenarios so that I can understand what will happen in each.

1. Rich is using one of the public university computers. He needs to log into the Ubuntu One interface to download a document to be printed for his next class. He logs in, successfully downloads and prints the file, and then he hits the logout button so that he can quickly get to class. Rich wants to confirm he is successfully logged out before leaving the workstation.

2. Emily visits a web-site that says she must authenticate using her Ubuntu SSO credentials. She clicks the login link, since she's already logged into other services with SSO it merely asks her if she wants to login. She chooses to and is sent to the new site. She decides this is not something she interested in using again and clicks the Logout button for the site. She doesn't want to log out of the other services she uses regularly.

3. Neil comes across a site that looks suspicious. It shows he is logged in and he doesn't like the idea and would prefer to browse this site anonymously. He hovers his mouse over the button and the status bar shows that the logout link points to the Ubuntu SSO service. (In fact, this is a malicious or mis-configured site and the link is not doing what it says it is doing). Neil clicks the link.

Do you think these three scenarios convey the range of features and concerns for this capability? If so, can you help me understand what is going to happen for each?