S-117225 Community - PBS SSO - Ensure PBS logout behaves correctly when an IDP does not support SLO
Description
We have improved our Single Sign-On (SSO) security to better support teams that use shared workstations. For organizations whose SSO providers do not support Single Logout (SLO), logging out of PBS will now completely clear your session. The next time you (or anyone else) attempts to log in to PBS on that device, the system will explicitly require you to re-enter your credentials. This ensures your account remains secure and prevents accidental account access by other users on shared devices.
Acceptance Criteria
GIVEN That idp.xml does not include slo logout url
WHEN a user tries to log in
THEN send forceauthn=true,
And users should always be forced to provide credentials rather than just being let in.
GIVEN That I am logged into PBS via SSO.
And That my IDP did not provide an SLO logout URL
WHEN I logout of PBS
THEN my login session should be blitzed
And my SSO provider should ask me for my credentials to log back in again if I try to access PBS again.