table of contents
DACS_SIGNOUT(8) | DACS Web Services Manual | DACS_SIGNOUT(8) |
NAME¶
dacs_signout - DACS signout serviceSYNOPSIS¶
dacs_signout [dacsoptions[1]]
DESCRIPTION¶
This web service is part of the DACS suite. The dacs_signout web service is invoked from a web browser to cause one or more sets of DACS credentials for the current federation[2], stored as HTTP cookies, to be removed from the browser. This is done by replacing one or more existing cookies with cookies that have expired. The effect is that the user agent signs out (logs off) identities previously obtained through dacs_authenticate(8)[3] or any other DACS authentication method. A DACS-enabled portal will typically provide users with a link or web page form to invoke this service. By default, all credentials are removed, but credentials can be selected for deletion based on a particular username (who the user was authenticated as) or a particular jurisdiction (the jurisdiction that performed that authentication). Should copies of the selected credentials exist outside of the browser, they may still be valid; only the browser's copies are destroyed. The SIGNOUT_HANDLER[4] directive can optionally be used to specify where the user should be redirected before this service terminates, provided FORMAT does not select a variety of XML output (see dacs.conf(5)[5]). If XML output is selected, a document conforming to dacs_current_credentials.dtd[6] is returned. Explicitly signing off using this web service is generally unnecessary because DACS credentials will either become invalid when their lifetime is reached (see AUTH_CREDENTIALS_DEFAULT_LIFETIME_SECS[7]) or will be automatically deleted when the user's browser session terminates (or a session with a trusted servlet ends). A user can also sign off by deleting his browser's DACS cookies. Middleware can simply discard cookies. As DACS credentials are relative to a particular federation of DACS servers, only those credentials that are associated with the federation of the DACS server that receives the service request will be affected by this service. This implies that a user who wants to explicitly sign out must do so for each federation in which he or she is currently authenticated.Web Service Arguments¶
In addition to the standard CGI arguments[8], dacs_signout understands the following CGI arguments: DACS_USERNAMEIf present, all credentials associated with this username
will be deleted. If not provided, the username in the credentials is
immaterial.
DACS_JURISDICTION
If present, all credentials associated with this
jurisdiction (given as its JURISDICTION_NAME[9]) will be deleted. If
not provided, the jurisdiction in the credentials is immaterial.
COOKIE_SYNTAX
This optional parameter is as described for the
dacs_authenticate(8)[3] service.
The optional parameters are used to delete only those credentials that match a
particular username or jurisdiction (or both). If neither parameter is
specified in the service request, all DACS cookies associated with the
federation that receives the service request will be deleted.
The name matching method can be configured through the NAME_COMPARE[10]
directive.
EXAMPLES¶
To signout from all identities in the EXAMPLE federation, a user would simply invoke a URL like: To signout only from the identity EXAMPLE::FEDROOT:bobo, a URL like the following might be invoked:https://fedroot.example.com/cgi-bin/dacs/dacs_signout?\ DACS_USERNAME=bobo&DACS_JURISDICTION=FEDROOT
DIAGNOSTICS¶
The program exits 0 if everything was fine, 1 if an error occurred.SEE ALSO¶
dacs_authenticate(8)[3], dacs_current_credentials(8)[13], dacs_auth_agent(8)[14], dacs_auth_transfer(8)[15], dacs_select_credentials(8)[16], dacsauth(1)[17], dacscred(1)[18] The DACS distribution includes an example of a "log off" web page: html/examples/signout.html[19].AUTHOR¶
Distributed Systems Software ( www.dss.ca[20])COPYING¶
Copyright2003-2012 Distributed Systems Software. See the LICENSE[21] file that accompanies the distribution for licensing information.NOTES¶
- 1.
- dacsoptions
- 2.
- current federation
- 4.
- SIGNOUT_HANDLER
- 5.
- dacs.conf(5)
- 6.
- dacs_current_credentials.dtd
- 7.
- AUTH_CREDENTIALS_DEFAULT_LIFETIME_SECS
- 8.
- standard CGI arguments
- 9.
- JURISDICTION_NAME
- 10.
- NAME_COMPARE
- 11.
- user tracking
- 12.
- dacs_acs(8)
- 17.
- dacsauth(1)
- 18.
- dacscred(1)
- 19.
- html/examples/signout.html
- 20.
- www.dss.ca
- 21.
- LICENSE
07/17/2013 | DACS 1.4.28b |