private void formLogout ( HttpServletRequest req , HttpServletResponse res ) throws ServletException , IOException { try { // if we have a valid custom logout page, set an attribute so SAML SLO knows about it. String exitPage = getValidLogoutExitPage ( req ) ; if ( exitPage != null ) { req . setAttribute ( "FormLogoutExitPage" , exitPage ) ; } authenticateApi . logout ( req , res , webAppSecurityConfig ) ; String str = null ; // if SAML SLO is in use, it will write the audit record and take care of the logoutExitPage redirection if ( req . getAttribute ( "SpSLOInProgress" ) == null ) { AuthenticationResult authResult = new AuthenticationResult ( AuthResult . SUCCESS , str ) ; authResult . setAuditLogoutSubject ( authenticateApi . returnSubjectOnLogout ( ) ) ; authResult . setAuditCredType ( "FORM" ) ; authResult . setAuditOutcome ( AuditEvent . OUTCOME_SUCCESS ) ; authResult . setTargetRealm ( authResult . realm ) ; Audit . audit ( Audit . EventID . SECURITY_AUTHN_TERMINATE_01 , req , authResult , Integer . valueOf ( res . getStatus ( ) ) ) ; redirectLogoutExitPage ( req , res ) ; } } catch ( ServletException se ) { String str = "ServletException: " + se . getMessage ( ) ; AuthenticationResult authResult = new AuthenticationResult ( AuthResult . FAILURE , str ) ; authResult . setAuditCredType ( "FORM" ) ; authResult . setAuditOutcome ( AuditEvent . OUTCOME_FAILURE ) ; authResult . setTargetRealm ( authResult . realm ) ; Audit . audit ( Audit . EventID . SECURITY_AUTHN_TERMINATE_01 , req , authResult , Integer . valueOf ( res . getStatus ( ) ) ) ; throw se ; } catch ( IOException ie ) { String str = "IOException: " + ie . getMessage ( ) ; AuthenticationResult authResult = new AuthenticationResult ( AuthResult . FAILURE , str ) ; authResult . setAuditCredType ( "FORM" ) ; authResult . setAuditOutcome ( AuditEvent . OUTCOME_FAILURE ) ; authResult . setTargetRealm ( authResult . realm ) ; Audit . audit ( Audit . EventID . SECURITY_AUTHN_TERMINATE_01 , req , authResult , Integer . valueOf ( res . getStatus ( ) ) ) ; throw ie ; } }
Log the user out by clearing the LTPA cookie if LTPA and SSO are enabled . Must also invalidate the http session since it contains user id and password . Finally if the user specified an exit page with a form parameter of logoutExitPage redirect to the specified page .