One of the things that we failed to mention in our initial diagram of a single logout was how the logout is performed. Unfortunately, it is implemented by storing a mapping of the service ticket to HttpSession as an in-memory map. This means that a single logout will not work properly within a clustered environment:
Consider the following situation:
- The user logs in to Cluster Member A
- Cluster Member A validates the service ticket
- It then remembers, in memory, the mapping of the service ticket to the user's session
- The user requests to log out from the CAS Server
The CAS Server sends a logout request to the CAS service, but the Cluster Member B receives the logout request. It looks in its memory but does not find a session for Service Ticket A, because it only exists in Cluster Member A. This means, the user has not been logged out successfully.
...
