Crowd SSO Logoff Inconsistencies

[markt2001]

Hi,

We have just got Confluence/JIRA/Fisheye and Crowd, and have set them up to integrate with each other, however there have been some odd issues with Single-Sign-On (SSO).

Single sign works correctly, but when you logoff, it does not behave as you would expect.

Signing off in either Confluence of JIRA causes themself + Fisheye to be logged off, but not the other (e.g. signing off JIRA will log off JIRA and Fisheye but not Confluence).

Where this really becomes a problem is if you then refresh confluence (who was not logged off), everyone gets logged on again (JIRA/Fisheye) because of SSO.

Is this a configuration problem? Any help or a point in the right direction would be great.

[markt2001 · Accepted solution]

Turns out it was a custom application that was causing issues and was using the simple authentication which didn't play nicely with single-sign-on.

[vmpn]

As we just learned Crowd SSO does not play nice with other SSOs. As the first thing crowd SSO does is logout the user and then perform its own login. So it ends up not playing nice with things like BasicAuth SSO. What happens is user gets logged in based on BasicAuth credentials but on subsequent requests that have BasicAuth headers Crowd logout logic kicks in causing user to be logged out and session destroyed. Did not get into details of what happens after but I would guess user gets logged in again based on BasicAuth with new session, but that wreaks havoc on Gadgets and other client side scripts. After turning off Crowd SSO (in our case we don't need it) behavior is a lot more as if working without SSO, though I still see some multiple sessions being used but nowhere near amount that it was before.

Posting this so others could benefit as this seemed the most relevant question

[markt2001]

Just wanted to note that we also had problems with the 'remember me' checkbox on both JIRA and Confluence which would just completely ignore the SSO and keep you logged in. So we basically have single-sign-on but not single-sign-off...