Bug 18549

Summary: There should be a warning that logging out of Koha will leave browser session logged in to OAuth
Product: Koha Reporter: Nick Clemens <nick>
Component: AuthenticationAssignee: Mark Tompsett <mtompset>
Status: In Discussion --- QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: costalc, dpavlin, hannah.co, jonathan.druart, katrin.fischer, martin.renvoize, matthias.meusburger, mtj, mtompset, nick
Version: Main   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Attachments: Bug 18549: Provide logout modal dialogue
Bug 18549: Provide logout modal dialogue

Description Nick Clemens 2017-05-05 10:10:03 UTC
From bug 16892

Nick:
For CAS we have casLogout - can we have something similar here? I think disconcerting if a patron signs in via google, signs out of Koha and walks away leaving their google auth intact unintentionally

Mark:
This is the problem. If you have multiple tabs, let's say gmail in one, and Koha in the other. If Koha does a forced logout, then your gmail tab will be affected.

This is the problem that is widely known. I was thinking of actually doing another bug to drop-down choose what kind of log out.

Martin:
A federated logout is actually pretty rare in my experience, though it is possible. 

As you say Mark, it 'feels' strange to the user that logging out of seemingly unrelated apps can have the knock on effect of logging out apps in other tabs that happen to share an aouth2 openid connect identity provider.  

On a related note, I'm not sure I saw any code out end to support such a federated logout triggered by another service in our end either... but perhaps I missed it ;)

Nick:
Perhaps if OAuth is activated just a note added that when you log out of Koha you may still be logged in via google?

I agree a user with many tabs open may not expect this, but a patron using a shared machine in the library who signs in to place a hold or renew may never visit their email or expect that they have signed in to that.

I think a pop-up when logging out to say "Hey, you are logged in to google, and they know lots of stuff about you" wouldn't hurt, who can say if it would help :-)

Mark:
Perhaps this type of discussion should happen on another bug report, as this bug has nothing to do with logging out. :)

Also, yes, some sort of warning should be displayed, somewhere, somehow.

Nick:
It can happen here now :-)
Comment 1 Mark Tompsett 2017-05-05 10:52:33 UTC
Thanks for the CC user on this bug. I'll attempt something for this problem, and see what you folks think.
Comment 2 Martin Renvoize 2017-05-05 11:04:15 UTC
Cheers for splitting this out. Great to hear you're going to give it a punt Mark, I'd love to see the federated logout fully implemented, but I'm not expecting that here.  If we do go down that route, I feel we need to impliment both ends in the same bug.. i.e. both our 'SLO caller' which needs to be attached to the logout button and the 'SLO listener' which if memory servers is a double iframe based hack in OpenID Connect.
Comment 3 Mark Tompsett 2017-05-05 12:45:04 UTC
(In reply to Martin Renvoize from comment #2)
> If we do go down that route, I feel we need to
> impliment both ends in the same bug.. i.e. both our 'SLO caller' which needs
> to be attached to the logout button and the 'SLO listener' which if memory
> servers is a double iframe based hack in OpenID Connect.

Or a simpler logout redirect.
http://stackoverflow.com/questions/4202161/google-account-logout-and-redirect
Though, I vaguely recall seeing the iframe business, and thinking, "YUCK!"

The thought is a modal popup with a nice message explaining the two choices: Koha Only or Koha+Google. The first does the normal URL, the later does the redirect URL.

Seem like a decent plan?
Comment 4 Mark Tompsett 2017-05-05 19:22:07 UTC
Created attachment 63198 [details] [review]
Bug 18549: Provide logout modal dialogue

I'm sure someone else could make the bootstrap and javascript
prettier. However, this functions.

TEST PLAN
---------
1) log in with Google OAuth and log out
   -- notice if you click login again, you continue as if you never logged out.
      This is because the current log out is a Koha only logout.
2) apply patch
3) log in with Google OAuth and log out
4) click 'Koha only'
5) log in with Google OAuth
   -- same continuation as before.
6) log out, but click 'Koha and Google'
7) log in with Google OAuth
   -- authentication is required again
8) koha qa test tools
Comment 5 Nick Clemens 2017-05-05 20:30:23 UTC
Created attachment 63212 [details] [review]
Bug 18549: Provide logout modal dialogue

I'm sure someone else could make the bootstrap and javascript
prettier. However, this functions.

TEST PLAN
---------
1) log in with Google OAuth and log out
   -- notice if you click login again, you continue as if you never logged out.
      This is because the current log out is a Koha only logout.
2) apply patch
3) log in with Google OAuth and log out
4) click 'Koha only'
5) log in with Google OAuth
   -- same continuation as before.
6) log out, but click 'Koha and Google'
7) log in with Google OAuth
   -- authentication is required again
8) koha qa test tools

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 6 Martin Renvoize 2017-05-09 09:20:05 UTC
I think this bug is somewhat misleading to the user, unfortunately.

Here's some questions that only the most technically aware will think to ask at this point.

1) If I login to app A (also a google openid connect consumer), then login to koha, then logout of app A will I be logged out of Koha too? - Current answer - No

2) If I loging to google, then login to Koha, then logout of Google will I also be logged out of Koha - Current answer - No

3) I've logged into Koha, then logged into App A, I then logout of Koha using the 'Logout of Koha and Google' option.. can I assume I'm also logged out of App A - Current Answer - No (and we can never ensure that either, as App A needs to support SLO too)

I think the current (as in, in master) implementation is more 'the norm' and that adding this patch actually obfuscates that clarity a bit more.. By allowing a 'logout of google too' option, you're inferring that a google logout affects koha in some way, when in fact it does not.
Comment 7 Martin Renvoize 2017-05-09 09:22:22 UTC
Would appreciate some more input on this really, I think for me it's all about being clear about what is happening and what we support.
Comment 8 Nick Clemens 2017-05-09 12:50:10 UTC
(In reply to Martin Renvoize from comment #7)
> Would appreciate some more input on this really, I think for me it's all
> about being clear about what is happening and what we support.

Your points about the 'logout of google' option are fair, I just still feel like there should be at least a warning that you might be logged in to google.

I suppose if an institution is enabling this option they bear some responsibility for training their users, a warning just seems friendly.  Perhaps a syspref to allow warning or federated logout with explanatory text in the manual about what apps need to support to allow this logout to work?
Comment 9 Mark Tompsett 2017-05-09 13:48:55 UTC
(In reply to Martin Renvoize from comment #6)
> I think this bug is somewhat misleading to the user, unfortunately.
[SNIP]
> I think the current (as in, in master) implementation is more 'the norm'

It is. The problem is that if users walk away, someone else can click 'login' and become the person who just left.


> and that adding this patch actually obfuscates that clarity a bit more.

That's what the whole dialogue message is supposed to make clear. If your objection is with the explanation, then feel free to suggest alternative wording.


> By allowing a 'logout of google too' option, you're inferring
> that a google logout affects koha in some way, when in fact it
> does not.

No, I am implying that by choosing that option, other google related tabs/windows in the same browser may be affected. You inferred incorrectly, so clearly the dialogue message needs tweaking, because 'Koha and Google' is the button name, not what you are logging in and out of manually in random order.

TAB A: GMail
TAB B: Koha OPAC logged in via OAuth
Click logout in OPAC.
Get dialogue (because you've applied this patch)
Click 'Koha and Google' your TAB A will be affected, and you will be forced to relogin in to continue reading your GMail.
But if you click 'Koha only', TAB A is not affected, but you suffer the next user can become you problem when the next person clicks the Koha OPAC login.

I suspect this is why people go with the most complex and horrid iframe solution, because that may do some authorization revoking without actually logging out and thus not have the potential identity theft issue.
Comment 10 Katrin Fischer 2017-05-10 20:51:12 UTC
We had a lot of similar discussions about Shibboleth around here. 

The patrons use public computers in the library to search, place holds etc. and then they walk away, unaware that they are still logged into email and several other services the single sign on works for - although they logged out of the OPAC. 

We could make the warning optional, but I think it would be a nice thing to have.
Comment 11 Mark Tompsett 2017-05-10 22:23:24 UTC
(In reply to Katrin Fischer from comment #10)
> We could make the warning optional, but I think it would be a nice thing to
> have.

A system preference: Koha Only (default), Koha and Google, Prompt (recommended to give users freedom of choice)?

If Koha Only, log out URL generates page similar to currently.
If Koha and Google, log out URL generates the double logout version.
If Prompt, modal popup like now.

Would that be acceptable?

I've been tinkering with revoking the authorization token after log in, the problem is Google stores session information in cookies, which I am having difficulty eliminating. This makes clicking on the previous email auto-magically log in.
google.com: SSID and SID, accounts.google.com: LSID, ACCOUNT_CHOOSER.
Get rid of those four cookies manually, and a login is forced without the previous email being remembered.