title: JASIG CAS: single sign out not working
body: <p>I have single sign on working beautifully, but single sign-out is not working.</p>
  
  <p>The scenario is like this:</p>
  
  <ol>
  <li>Open webapp1 and get redirected to CAS login page</li>
  <li>Enter details and login</li>
  <li>Open webapp2 which also uses CAS. Automatically logs in, as the user already signed in.</li>
  <li>Log out of webapp1</li>
  <li>Try to open webapp1 or webapp2 (in another tab) redirects you back to the login page.</li>
  <li>However, the session to webapp2 in step 3 is not closed and the user can still use the application without any problems. How do I automatically invalidate the session when the user signs out?</li>
  </ol>
  
  <p>The log off button for both applications first call <code>session.invalidate()</code> and then redirects to <code>https://localhost:8443/cas/logout</code></p>
  
  <p>The single sign out filter is the first filter in the web.xml file.  I also have the <code>SingleSignOutHttpSessionListener</code> in web.xml.</p>
  
  <p>Following is the extract from my web.xml</p>
  
  <pre><code>&lt;!-- CAS settings --&gt;
  &lt;!-- Use filter init-param if your container does not support context params. 
      CAS Authentication Filter and CAS Validation Filter need a serverName init-param 
      in lieu of a context-param definition. --&gt;
  &lt;context-param&gt;
      &lt;param-name&gt;serverName&lt;/param-name&gt;
      &lt;param-value&gt;https://localhost:8443&lt;/param-value&gt;
  &lt;/context-param&gt;
  
    &lt;!-- Facilitates CAS single sign-out --&gt;
    &lt;listener&gt;
          &lt;listener-class&gt;org.jasig.cas.client.session.SingleSignOutHttpSessionListener&lt;/listener-class&gt;
    &lt;/listener&gt;
  
    &lt;!--
    CAS client filters
    Single sign-out filter MUST come first since it needs to be evaluated
    before other filters.
    --&gt;
    &lt;filter&gt;
          &lt;filter-name&gt;CAS Single Sign Out Filter&lt;/filter-name&gt;
          &lt;filter-class&gt;org.jasig.cas.client.session.SingleSignOutFilter&lt;/filter-class&gt;
    &lt;/filter&gt;
  
    &lt;filter&gt;
          &lt;filter-name&gt;CAS Authentication Filter&lt;/filter-name&gt;
          &lt;!--
          IMPORTANT:
          Use Saml11AuthenticationFilter for version 3.1.12 and later.
          Use org.jasig.cas.client.authentication.AuthenticationFilter for previous
          versions.
          --&gt;
          &lt;filter-class&gt;
                org.jasig.cas.client.authentication.Saml11AuthenticationFilter&lt;/filter-class&gt;
          &lt;init-param&gt;
                &lt;param-name&gt;casServerLoginUrl&lt;/param-name&gt;
                &lt;param-value&gt;https://localhost:8443/cas/login&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;init-param&gt;
          &lt;param-name&gt;service&lt;/param-name&gt;
          &lt;param-value&gt;https://localhost:8443/JAdaptiv/default.action&lt;/param-value&gt;
      &lt;/init-param&gt;
    &lt;/filter&gt;
  
    &lt;filter&gt;
          &lt;filter-name&gt;CAS Validation Filter&lt;/filter-name&gt;
          &lt;filter-class&gt;
                org.jasig.cas.client.validation.Saml11TicketValidationFilter&lt;/filter-class&gt;
          &lt;init-param&gt;
                &lt;param-name&gt;casServerUrlPrefix&lt;/param-name&gt;
                &lt;param-value&gt;https://localhost:8443/cas&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;init-param&gt;
                &lt;param-name&gt;redirectAfterValidation&lt;/param-name&gt;
                &lt;param-value&gt;true&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;init-param&gt;
                &lt;!-- Leniency of time checking in ms when validating SAML assertions. Consider 
                      setting this parameter more liberally if you anticipate system clock drift 
                      on your application servers relative to the CAS server. The default is 1000 
                      (1s) and at least one person had problems with drift at that small a tolerance 
                      value. A good approach is to start low and then increase by 1000 as needed 
                      until problems stop. Note that increasing this value may have negative security 
                      implications. Consider fixing clock drift problems as an alternative. --&gt;
                &lt;param-name&gt;tolerance&lt;/param-name&gt;
                &lt;param-value&gt;1000&lt;/param-value&gt;
          &lt;/init-param&gt;
    &lt;/filter&gt;
  
    &lt;filter&gt;
          &lt;filter-name&gt;CAS HttpServletRequest Wrapper Filter&lt;/filter-name&gt;
          &lt;filter-class&gt;
                org.jasig.cas.client.util.HttpServletRequestWrapperFilter&lt;/filter-class&gt;
    &lt;/filter&gt;
  
    &lt;filter&gt;
          &lt;filter-name&gt;CAS Assertion Thread Local Filter&lt;/filter-name&gt;
          &lt;filter-class&gt;org.jasig.cas.client.util.AssertionThreadLocalFilter&lt;/filter-class&gt;
    &lt;/filter&gt;
  
    &lt;filter-mapping&gt;
          &lt;filter-name&gt;CAS Single Sign Out Filter&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
    &lt;/filter-mapping&gt;
  
    &lt;filter-mapping&gt;
          &lt;filter-name&gt;CAS Authentication Filter&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
    &lt;/filter-mapping&gt;
  
    &lt;filter-mapping&gt;
          &lt;filter-name&gt;CAS Validation Filter&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
    &lt;/filter-mapping&gt;
  
    &lt;filter-mapping&gt;
          &lt;filter-name&gt;CAS HttpServletRequest Wrapper Filter&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
    &lt;/filter-mapping&gt;
  
    &lt;filter-mapping&gt;
      &lt;filter-name&gt;CAS Assertion Thread Local Filter&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  </code></pre>