investigate/implement log out link

[jmartin-sul]

Follow on to #1763 / #1531

Both the simpler and the more complex designs for the banner displayed to logged in Stanford users called for a logout button. In my limited testing, I couldn't get to anything that worked. I was pointed to examples in H2 (see comment from original issue for detail), MyLibrary, and Mirador, but didn't have any luck working off of them.

what's I tried so far that didn't work at all

The H2 and MyLibrary examples both redirect the user through /Shibboleth.sso/Logout. When I did that manually to test using e.g. https://embed-stage.stanford.edu/Shibboleth.sso/Logout, I got a 404. Everything else in the H2 and MyLibrary examples was around clearing Devise and Warden sessions, but sul-embed doesn't use either of those gems or track login via its own Rails session.

Maybe more relevant, since sul-embed uses stacks for serving content and minting auth tokens for Wowza, the Mirador example redirects through stacks' /auth/logout route. But when I use that Mirador logout link from the prod example above (https://stacks.stanford.edu/auth/logout), I'm still logged in for the purposes of viewing videos in sul-embed on purl prod. Same for when I manually hit https://sul-stacks-stage.stanford.edu/auth/logout and am still logged in for video viewing on PURL/Embed stage.

A possible lead

Redirect through https://sul-stacks-stage.stanford.edu/Shibboleth.sso/Logout. I tried this and it seems like it might've worked, but it was clunky, opaque, and maybe overly broad when it did work. When I hit that link, I was given two options, Logout Locally, and Logout Globally:

Logout locally didn't do anything for me the first time I tried it. Then when I used Logout Globally, it did indeed log me out in such a way that visiting a video on a PURL page gave me a login banner again, on both stage and prod. But then once I logged in again, if I retried https://sul-stacks-stage.stanford.edu/Shibboleth.sso/Logout, I was presented with the following with no options:

And I remained logged in for the purposes of streaming video via PURL/Embed/Wowza/Stacks.

If I then tried https://stacks.stanford.edu/Shibboleth.sso/Logout, I was presented the same plain "Your single sign-on cookie has been deleted" page, but my prod Stacks login was actually cleared (had to click through Login again to watch a video on PURL prod), but not my stage Stacks login (still not prompted to login again to watch a PURL stage video).

Very squirrely.