The ability to kick users off is a nice to have feature such that
if we manually deleted browser cookie "crowd.token_key" then
Drupal should notice the missing token and log the user out,
similarly an expiration timestamp should be used such that
when the Crowd admin kicks a user off on the Crowd side
after X amount of time their Drupal cookie auto expires
forcing users out.

Comments

benmirkhah’s picture

benmirkhah commented

A more secure approach would require validation of
Crowd cookie token for every session request at the
cost of a SOAP call to isValidated() method, slight
disadvantage in speed for the benefit of security.

benmirkhah’s picture

benmirkhah commented
Assigned: Unassigned » benmirkhah
ebeyrent’s picture

ebeyrent commented
Issue tags: +token, +auth, +Security, +verification, +crowd

Automatic logout is supported if the user has logged out of Crowd, has logged out of Drupal, and the cookie has either been expired or deleted.

You are correct that it is certainly more secure to make the call on every page load, but I am really concerned about performance issues on sites with lots of authenticated users. Every page load would require the SOAP call, which ties up a thread for n seconds until a response is received. This potentially places a huge load on the web server, not to mention the load on Crowd itself.

One option would be to make this a configurable behavior, and in the admin settings, add a warning about potential negative impacts to performance.

Anyone up for doing a little load testing to see what the impact is?

benmirkhah’s picture

benmirkhah commented

Agreed, validation on every page needs to be a configurable option and we'd be glad to test it.

ebeyrent’s picture

ebeyrent commented
Assigned: benmirkhah » ebeyrent
ebeyrent’s picture

ebeyrent commented

Latest commit adds the option as described in #3.

http://drupal.org/cvs?commit=350930

ebeyrent’s picture

ebeyrent commented
Status: Active » Fixed

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

benmirkhah’s picture

benmirkhah commented

using Crowd URI: crowd/services/SecurityServer?wsdl
instead of default /crowd worked for us.

Crowd Cookie SSO Domain should remain consistent across all SSO apps: ".example.com"