Build a J2EE web application using Oracle SSO with OID content as a means of authenticating users.
If the user wants to use the application, he must first specify a valid username / password on the SSO login page.
When the user is executed using the application, he can click the logout button; Behind the scenes, the action associated with this button will terminate the user's session and clear cookies using the following Java code:
private void clearCookies(HttpServletResponse res, HttpServletRequest req) { res.setContentType("text/html"); for (Cookie cookie : req.getCookies()) { cookie.setMaxAge(0); cookie.setPath("/"); cookie.setDomain(req.getHeader("host")); res.addCookie(cookie); } }
In addition, I have an onclick JavaScript event associated with a logout button that should delete SSO cookies by calling the delOblixCookie () function (as shown in some Oracle forum):
function delCookie(name, path, domain) { var today = new Date(); // minus 2 days var deleteDate = new Date(today.getTime() - 48 * 60 * 60 * 1000); var cookie = name + "=" + ((path == null) ? "" : "; path=" + path) + ((domain == null) ? "" : "; domain=" + domain) + "; expires=" + deleteDate; document.cookie = cookie; } function delOblixCookie() { // set focus to ok button var isNetscape = (document.layers); if (isNetscape == false || navigator.appVersion.charAt(0) >= 5) { for (var i=0; i<document.links.length; i++) { if (document.links.href == "javascript:top.close()") { document.links.focus(); break; } } } delCookie('ObTEMC', '/'); delCookie('ObSSOCookie', '/'); // in case cookieDomain is configured delete same cookie to all subdomains var subdomain; var domain = new String(document.domain); var index = domain.indexOf("."); while (index > 0) { subdomain = domain.substring(index, domain.length); if (subdomain.indexOf(".", 1) > 0) { delCookie('ObTEMC', '/', subdomain); delCookie('ObSSOCookie', '/', subdomain); } domain = subdomain; index = domain.indexOf(".", 1); } }
However, my users do not exit SSO after they click the logout button: although a new session is created if they try to access the index page, the SSO login page does not appear to them, and they can go directly to the main page without authentication. Only if they manually delete cookies from the browser, the login page appears again - not what I need: users must provide their username / password each time they exit the application, so I believe that the code that deletes cookies
Id really appreciate any help with this problem, thanks in advance.