Django user logout with remote authentication

Question

I have a website that uses remote authentication via Kerberos. I've set everything up according to the Django documentation (https://docs.djangoproject.com/en/dev/howto/auth-remote-user/). Logging in works great, however logging out doesn't end the session. What can I do to ensure the user is fully logged out? Closing the browser window entirely does seem to work, but users need to have the ability to log out without closing the browser window.

Answer 1

Use HttpResponse to return status 401.

def logout(request):
    return HttpResponse(content, status=401)

This will log the user out from Kerebos.

Credit: I saw this solution elsewhere related to Basic Authentication.

Answer 2

When user logs out from django, django session is destroyed, but user is still logged to Kerberos, and next request will automagically create new session again. You can't do anything about it in your django application. User have to log out from Kerberos himself, because Kerberos might be used to authenticate user in other services/applications at the same time.