Spring Security - Third Edition

Single logout

You may notice that if you log out of the application, you get the logout confirmation page. However, if you click on a protected page, such as the My Events page, you are still authenticated. The problem is that the logout is only occurring locally. So, when you request another protected resource in the JBCP calendar application, a login is requested from the CAS server. Since the user is still logged in to the CAS server, it immediately returns a service ticket and logs the user back into the JBCP calendar application.

This also means that if the user had signed in to other applications using the CAS server, they would still be authenticated to those applications, since our calendar application does not know anything about ...