Jasig/cas — pull request #417 by mmoayyed (2014-04-03 16:46:10+00:00)
Title: CAS-1414: Expired TGT on ST generation does not invoke logout

https://issues.jasig.org/browse/CAS-1414

In the event that TGT has expired (due to a very aggressive timeout), CAS currently does not initiate the logout protocol when a service request comes in. This is because when the ST-grant logic is executed, the expired TGT is simply removed from the registry, rather than "destroyed" via the CAS API.

To clarify, consider the following scenario:

- Set TGT Timeout to 30 seconds
- Set ticketCleaner interval to 3 minutes
- Log into Webapp A
- Wait 31 seconds so the TGT expires

Go to Webapp B. You can't login because the ticket has expired, but CAS server has deleted the ticket right away without sending logout request to Webapp A. The result is Webapp A still logged in and will never be logged out.