3

Scenario:

  1. User is on default login page

  2. User clicks on windows authentication, (s)he is prompted for username and password

  3. User is navigated to the home page

  4. Click on Sign Out Link

  5. User is navigated to the default login page

  6. Click on windows authentication, (s)he is not prompted for username and password, and logged in with the previous user credentials. Here the user should be again prompted for username and password

Improve this question
6

In step 5 your users should be redirected to the SignOut.aspx page telling them to close the browser.

With claims based authentication the SAML token which contains the authenticated user is stored as a session cookie.

When the user signs out there is no easy way for SharePoint to clear that cookie for all the SharePoint web applications/domains where it may have been issued.
SharePoint therefore doesn't even try to clear this cookie, but just informs the User to close the browser as this is the only way which will always work.

Improve this answer
  • So are there any ways using which i can clear those auth tokens, lets say deleting any specific cookie. – user4205 Dec 10 '13 at 6:42
  • In theory: Yes, on the Signin page you could include links to urls in each domain pointing to a page clearing the cookie and returning a small image, this is how it's often done. In practice: No, each app instance gets it's own domain, so you'll be required to know which apps the user has visited. So my advice is: Don't try as you'll miss something which then might cause problems. Learn the users to close the browser before signing in again. – Per Jakobsen Dec 10 '13 at 8:40
  • Per, you seem to miss the point that the user has closed the page and then when reloading the sharepoint link user gets in automatically without being prompted for a password. – user41695 Apr 23 '15 at 3:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.