Single Logout

You may notice that if you log out of the application, you get a logout confirmation page. However, if you click on a protected page, such as the My Events page, you are still authenticated. The problem is that the logout is only occurs locally. So, when you request another protected resource in the JBCP Calendar application, a login is requested from the CAS server. Since the user is still logged in to the CAS server, it immediately returns a service ticket and logs the user back into the JBCP Calendar application.

This also means that if the user had signed in to other applications using the CAS server, they would still be authenticated to those applications, since our calendar application does not know anything about the other applications. Fortunately, CAS and Spring Security offer a solution to this problem. Just as we can request a login from the CAS server, we can also request a logout.

You can see a high-level diagram of how logging out works within CAS...