title: CAS Single LogOut(SLO) not working - CAS 4.2.3
body: <p>I am having issues with Single LogOut in CAS. I am using CAS server 4.2.3 and Spring 3.2. My client casified applications are configured on spring security. Followed the following documentation, <a href="http://docs.spring.io/spring-security/site/docs/3.2.9.RELEASE/reference/htmlsingle/#cas-singlelogout" rel="nofollow">http://docs.spring.io/spring-security/site/docs/3.2.9.RELEASE/reference/htmlsingle/#cas-singlelogout</a></p>
  
  <p>I have 2 cas client web application. When I logout from one of the cas client web application, and refresh the page in the 2nd cas client application which I already logged in (in the same browser in a different tab), I would think that the login page would show up as I already did a single LogOut from the 1st cas client application. But it doesn't work. </p>
  
  <p>I am not sure what I am missing. I have posted the code snippet of web.xml, spring-security.xml, logout.jsp and cas.log</p>
  
  <p>Any help or pointers is greatly appreciated. </p>
  
  <p><strong>web.xml</strong></p>
  
  <pre><code>&lt;filter&gt;
      &lt;filter-name&gt;characterEncodingFilter&lt;/filter-name&gt;
      &lt;filter-class&gt;org.springframework.web.filter.CharacterEncodingFilter&lt;/filter-class&gt;
      &lt;init-param&gt;
          &lt;param-name&gt;encoding&lt;/param-name&gt;
          &lt;param-value&gt;UTF-8&lt;/param-value&gt;
      &lt;/init-param&gt;
  &lt;/filter&gt;
  
  &lt;filter&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
  &lt;/filter&gt;
  
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;characterEncodingFilter&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  
  &lt;listener&gt;
      &lt;listener-class&gt;org.jasig.cas.client.session.SingleSignOutHttpSessionListener&lt;/listener-class&gt;
  &lt;/listener&gt;
  
  &lt;listener&gt;
      &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
  &lt;/listener&gt;
  </code></pre>
  
  <p><strong>spring-security.xml</strong></p>
  
  <pre><code>&lt;bean id="serviceProperties" class="org.springframework.security.cas.ServiceProperties"&gt;
      &lt;property name="service" value="https://&lt;hostname&gt;:8444/WebApp3/j_spring_cas_security_check" /&gt;
      &lt;property name="sendRenew" value="false" /&gt;
  &lt;/bean&gt;
  
  &lt;sec:http use-expressions="true" entry-point-ref="casEntryPoint"&gt;
      &lt;sec:intercept-url pattern="/login/*" access="permitAll()" /&gt;
      &lt;sec:intercept-url pattern="/lib/**" access="permitAll()" /&gt;
      &lt;sec:intercept-url pattern="/**" access="isAuthenticated()" /&gt;
      &lt;sec:form-login login-page="/ingress.do" default-target-url="/ingress.do" always-use-default-target="false"
          authentication-failure-url="/login.jsp" /&gt;
  
      &lt;sec:logout logout-success-url="/logout.jsp" /&gt;
      &lt;sec:custom-filter ref="requestSingleLogoutFilter" before="LOGOUT_FILTER" /&gt;
      &lt;sec:custom-filter ref="singleLogoutFilter" before="CAS_FILTER" /&gt;
      &lt;sec:custom-filter position="CAS_FILTER" ref="casFilter" /&gt;
  
  &lt;/sec:http&gt;
  
  &lt;bean id="singleLogoutFilter" class="org.jasig.cas.client.session.SingleSignOutFilter" /&gt;
  
  &lt;bean id="requestSingleLogoutFilter" class="org.springframework.security.web.authentication.logout.LogoutFilter"&gt;
      &lt;constructor-arg value="https://&lt;hostname&gt;/cas/logout" /&gt;
      &lt;constructor-arg&gt;
          &lt;bean class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler" /&gt;
      &lt;/constructor-arg&gt;
      &lt;property name="filterProcessesUrl" value="/logout/cas" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="casFilter" class="org.springframework.security.cas.web.CasAuthenticationFilter"&gt;
      &lt;property name="authenticationManager" ref="authenticationManager" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="casEntryPoint" class="org.springframework.security.cas.web.CasAuthenticationEntryPoint"&gt;
      &lt;property name="loginUrl" value="https://&lt;hostname&gt;/cas/login" /&gt;
      &lt;property name="serviceProperties" ref="serviceProperties" /&gt;
  &lt;/bean&gt;
  
  &lt;sec:authentication-manager alias="authenticationManager"&gt;
      &lt;sec:authentication-provider ref="casAuthenticationProvider" /&gt;
  &lt;/sec:authentication-manager&gt;
  
  &lt;bean id="casAuthenticationProvider" class="org.springframework.security.cas.authentication.CasAuthenticationProvider"&gt;
      &lt;property name="authenticationUserDetailsService"&gt;
          &lt;bean class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper"&gt;
              &lt;constructor-arg ref="userService" /&gt;
          &lt;/bean&gt;
      &lt;/property&gt;
      &lt;property name="serviceProperties" ref="serviceProperties" /&gt;
      &lt;property name="ticketValidator"&gt;
          &lt;bean class="org.jasig.cas.client.validation.Cas20ServiceTicketValidator"&gt;
              &lt;constructor-arg index="0" value="https://&lt;hostname&gt;/cas" /&gt;
          &lt;/bean&gt;
      &lt;/property&gt;
      &lt;property name="key" value="an_id_for_this_auth_provider_only" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="userService" class="org.hpi.iris.services.CustomUserDetailsService" /&gt;
  
  &lt;bean id="logoutFilter" class="org.springframework.security.web.authentication.logout.LogoutFilter"&gt;
      &lt;constructor-arg value="/" /&gt;
      &lt;constructor-arg&gt;
          &lt;list&gt;
              &lt;bean class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler" /&gt;
          &lt;/list&gt;
      &lt;/constructor-arg&gt;
  &lt;/bean&gt;
  
  &lt;bean id="servletContext" class="org.springframework.web.context.support.ServletContextFactoryBean" /&gt;
  
  &lt;bean id="etf" class="org.springframework.security.web.access.ExceptionTranslationFilter"&gt;
      &lt;property name="authenticationEntryPoint" ref="casEntryPoint" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="wrappingFilter" class="org.jasig.cas.client.util.HttpServletRequestWrapperFilter" /&gt;
  </code></pre>
  
  <p></p>
  
  <p><strong>logout.jsp</strong></p>
  
  <pre><code>&lt;a href="logout/cas"&gt;Logout of in all applications&lt;/a&gt;
  </code></pre>
  
  <p><strong>cas.log</strong></p>
  
  <pre><code>2016-09-19 15:47:09,995 DEBUG [org.jasig.cas.logout.SamlCompliantLogoutMessageCreator] - Generated logout message: [&lt;samlp:LogoutRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="LR-1-qFurZ54zaXVbviIalCkZ93lDbYuBAT6m5qE" Version="2.0" IssueInstant="2016-09-19T15:47:09Z"&gt;&lt;saml:NameID xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"&gt;@NOT_USED@&lt;/saml:NameID&gt;&lt;samlp:SessionIndex&gt;ST-2-Ag6SgNIyvMUGT9mKNkEo-&lt;hostname&gt;&lt;/samlp:SessionIndex&gt;&lt;/samlp:LogoutRequest&gt;]
  2016-09-19 15:47:09,995 DEBUG [org.jasig.cas.logout.LogoutManagerImpl] - Sending logout request for: [https://&lt;hostname&gt;:8444/WebApp3/j_spring_cas_security_check]
  2016-09-19 15:47:10,000 DEBUG [org.jasig.cas.logout.LogoutManagerImpl] - Prepared logout message to send is [org.jasig.cas.logout.LogoutManagerImpl$LogoutHttpMessage@1771cadc[url=https://&lt;hostname&gt;:8444/WebApp3/j_spring_cas_security_check,message=&lt;samlp:LogoutRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="LR-1-qFurZ54zaXVbviIalCkZ93lDbYuBAT6m5qE" Version="2.0" IssueInstant="2016-09-19T15:47:09Z"&gt;&lt;saml:NameID xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"&gt;@NOT_USED@&lt;/saml:NameID&gt;&lt;samlp:SessionIndex&gt;ST-2-Ag6SgNIyvMUGT9mKNkEo-&lt;hostname&gt;&lt;/samlp:SessionIndex&gt;&lt;/samlp:LogoutRequest&gt;,asynchronous=true,contentType=application/x-www-form-urlencoded]]
  2016-09-19 15:47:10,068 DEBUG [org.jasig.cas.logout.LogoutManagerImpl] - Captured logout request [org.jasig.cas.logout.DefaultLogoutRequest@655231e3[ticketId=ST-2-Ag6SgNIyvMUGT9mKNkEo-&lt;hostname&gt;,service=https://&lt;hostname&gt;:8444/WebApp3/j_spring_cas_security_check,status=SUCCESS]]
  2016-09-19 15:47:10,069 DEBUG [org.jasig.cas.ticket.registry.DefaultTicketRegistry] - Attempting to retrieve ticket [TGT-**********************************************lfaFE4hhow-&lt;hostname&gt;]
  2016-09-19 15:47:10,071 DEBUG [org.jasig.cas.ticket.registry.DefaultTicketRegistry] - Ticket [TGT-**********************************************lfaFE4hhow-&lt;hostname&gt;] found in registry.
  2016-09-19 15:47:10,072 DEBUG [org.jasig.cas.ticket.registry.DefaultTicketRegistry] - Removing children of ticket [TGT-**********************************************lfaFE4hhow-&lt;hostname&gt;] from the registry.
  2016-09-19 15:47:10,084 DEBUG [org.jasig.cas.ticket.registry.DefaultTicketRegistry] - Removing ticket [TGT-**********************************************lfaFE4hhow-&lt;hostname&gt;] from the registry.
  2016-09-19 15:47:10,099 DEBUG [org.jasig.cas.CentralAuthenticationServiceImpl] - Publishing org.jasig.cas.support.events.CasTicketGrantingTicketDestroyedEvent@b348523[ticketGrantingTicket=TGT-**********************************************lfaFE4hhow-&lt;hostname&gt;]
  2016-09-19 15:47:10,100 DEBUG [org.jasig.cas.audit.spi.AssertionAsReturnValuePrincipalResolver] - Trying to see if target's return value is instance of [Assertion]...
  2016-09-19 15:47:10,100 DEBUG [org.jasig.cas.audit.spi.AssertionAsReturnValuePrincipalResolver] - Resolving principal from the delegate principal resolver: [org.jasig.cas.audit.spi.TicketOrCredentialPrincipalResolver@3d5cf9c4]...
  2016-09-19 15:47:10,100 DEBUG [org.jasig.cas.audit.spi.TicketOrCredentialPrincipalResolver] - Resolving argument [String] for audit
  2016-09-19 15:47:10,100 DEBUG [org.jasig.cas.ticket.registry.DefaultTicketRegistry] - Attempting to retrieve ticket [TGT-**********************************************lfaFE4hhow-&lt;hostname&gt;]
  2016-09-19 15:47:10,101 DEBUG [org.jasig.cas.CentralAuthenticationServiceImpl] - Ticket [TGT-**********************************************lfaFE4hhow-&lt;hostname&gt;] by type [Ticket] cannot be found in the ticket registry.
  2016-09-19 15:47:10,109 DEBUG [org.jasig.cas.audit.spi.TicketOrCredentialPrincipalResolver] - Could not locate ticket [TGT-**********************************************lfaFE4hhow-&lt;hostname&gt;] in the registry
  2016-09-19 15:47:10,110 DEBUG [org.jasig.cas.audit.spi.AssertionAsReturnValuePrincipalResolver] - Meaningful principal id could not be resolved by [org.jasig.cas.audit.spi.AssertionAsReturnValuePrincipalResolver@4dafaeaa]. Returning [audit:unknown]...
  2016-09-19 15:47:10,110 DEBUG [org.jasig.cas.web.support.TGCCookieRetrievingCookieGenerator] - Removed cookie with name [TGC]
  2016-09-19 15:47:10,110 DEBUG [org.jasig.cas.web.WarningCookieRetrievingCookieGenerator] - Removed cookie with name [CASPRIVACY]
  2016-09-19 15:47:10,118 DEBUG [org.jasig.cas.services.web.RegisteredServiceThemeBasedViewResolver] - View resolved: /WEB-INF/view/jsp/default/ui/casLogoutView.jsp
  2016-09-19 15:47:10,179 DEBUG [org.jasig.cas.authentication.FileTrustStoreSslSocketFactory] - Connecting socket to &lt;hostname&gt;/&lt;hostip&gt;:8444 with timeout 5000
  2016-09-19 15:47:10,181 DEBUG [org.jasig.cas.authentication.FileTrustStoreSslSocketFactory] - Enabled protocols: [TLSv1, TLSv1.1, TLSv1.2]
  2016-09-19 15:47:10,181 DEBUG [org.jasig.cas.authentication.FileTrustStoreSslSocketFactory] - Enabled cipher suites:[TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
  2016-09-19 15:47:10,181 DEBUG [org.jasig.cas.authentication.FileTrustStoreSslSocketFactory] - Starting handshake
  2016-09-19 15:47:10,205 DEBUG [org.jasig.cas.authentication.FileTrustStoreSslSocketFactory] - Secure session established
  2016-09-19 15:47:10,206 DEBUG [org.jasig.cas.authentication.FileTrustStoreSslSocketFactory] -  negotiated protocol: TLSv1.2
  2016-09-19 15:47:10,206 DEBUG [org.jasig.cas.authentication.FileTrustStoreSslSocketFactory] -  negotiated cipher suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
  2016-09-19 15:47:10,206 DEBUG [org.jasig.cas.authentication.FileTrustStoreSslSocketFactory] -  peer principal: CN=&lt;hostname&gt;, OU=HPI, O=HP, L=Bloomington, ST=MN, C=US
  2016-09-19 15:47:10,206 DEBUG [org.jasig.cas.authentication.FileTrustStoreSslSocketFactory] -  issuer principal: CN=&lt;hostname&gt;, OU=HPI, O=HP, L=Bloomington, ST=MN, C=US
  2016-09-19 15:47:31,024 DEBUG [org.jasig.cas.util.CasSpringBeanJobFactory] - Created job org.jasig.cas.services.DefaultServicesManagerImpl$ServiceRegistryReloaderJob@4340fcf7 for bundle org.quartz.spi.TriggerFiredBundle@8f5988b
  </code></pre>