logout-webflow.xml檔案定義了cas登出工作流，

登出第一步

登出第一步定義如下：

  <action-state id="terminateSession">
    <evaluate expression="terminateSessionAction.terminate(flowRequestContext)" />
    <transition to="doLogout" />
  </action-state>

terminateSessionAction bean定義如下：

<bean id="terminateSessionAction" class="org.jasig.cas.web.flow.TerminateSessionAction"
        c:cas-ref="centralAuthenticationService"
        c:tgtCookieGenerator-ref="ticketGrantingTicketCookieGenerator"
        c:warnCookieGenerator-ref="warnCookieGenerator"/>
 

首先分析org.jasig.cas.web.flow.TerminateSessionAction類的terminate()方法：

public Event terminate(final RequestContext context) {
        // in login's webflow : we can get the value from context as it has already been stored
        String tgtId = WebUtils.getTicketGrantingTicketId(context);
        // for logout, we need to get the cookie's value
        if (tgtId == null) {
            final HttpServletRequest request = WebUtils.getHttpServletRequest(context);
            tgtId = this.ticketGrantingTicketCookieGenerator.retrieveCookieValue(request);
        }
        if (tgtId != null) {
            WebUtils.putLogoutRequests(context, this.centralAuthenticationService.destroyTicketGrantingTicket(tgtId));
        }
        final HttpServletResponse response = WebUtils.getHttpServletResponse(context);
        this.ticketGrantingTicketCookieGenerator.removeCookie(response);
        this.warnCookieGenerator.removeCookie(response);
        return this.eventFactorySupport.success(this);
    }
 

1.從上下文中獲取“ticketGrantingTicketId”。優先從RequestScope中獲取“ticketGrantingTicketId”，如果為空，則從FlowScope中獲取同等引數

2.如果TGT為空，則從快取中獲取

3.銷燬TGT資源。

    1）從根據TGT從ticketRegistry獲取TicketGrantingTicket物件（實際是TicketGrantingTicketImpl物件）

     2） 獲取TGT物件所有service，並從TGT物件中移除；設定TGT物件為過期狀態；如果啟用單點登出，則遍歷所有servcice物件，對每個物件做如下處理：

        2.1）檢查service物件是否屬於SingleLogoutService類的例項，如果是，並且該service未登出，則new一個LogoutRequest物件（入參就是該service物件），並且新增到LogoutRequest列表中

        2.2）servicesManager查詢該service物件，得到註冊的RegisteredService物件

        2.3）如果RegisteredService物件為空，或者RegisteredService物件的登出型別為空，或者登出型別為BACK_CHANNEL，則建立一個登出訊息，內容如下：

<samlp:LogoutRequest
    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
    ID="[RANDOM ID]"
    Version="2.0"
    IssueInstant="[CURRENT DATE/TIME]">
    <saml:NameID>@[email protected]</saml:NameID>
    <samlp:SessionIndex>[SESSION IDENTIFIER]</samlp:SessionIndex>
</samlp:LogoutRequest>

然後設定該service物件為已經登出，通過httpclient向service的OriginalUrl傳送請求，如果傳送成功，則設定該LogoutRequest未成功處理過了的標誌，否則設定處理失敗標誌。

最後返回LogoutRequest列表

    3）從ticketRegistry中移除TGT物件

4.將前面返回的LogoutRequest列表放到FlowScope的"logoutRequests"中儲存

5.從response中移除cookie

登出第2步

工作流定義如下：

<action-state id="doLogout">
    <evaluate expression="logoutAction" />
    <transition on="finish" to="finishLogout" />
    <transition on="front" to="frontLogout" />
  </action-state>

logoutAction的bean定義如下：

  <bean id="logoutAction" class="org.jasig.cas.web.flow.LogoutAction"
        p:servicesManager-ref="servicesManager"
        p:followServiceRedirects="${cas.logout.followServiceRedirects:true}"/>

直接看LogoutAction的核心方法：

protected Event doInternalExecute(final HttpServletRequest request, final HttpServletResponse response,
            final RequestContext context) throws Exception {

        boolean needFrontSlo = false;
        putLogoutIndex(context, 0);
        final List<LogoutRequest> logoutRequests = WebUtils.getLogoutRequests(context);
        if (logoutRequests != null) {
            for (LogoutRequest logoutRequest : logoutRequests) {
                // if some logout request must still be attempted
                if (logoutRequest.getStatus() == LogoutRequestStatus.NOT_ATTEMPTED) {
                    needFrontSlo = true;
                    break;
                }
            }
        }

        final String service = request.getParameter("service");
        if (this.followServiceRedirects && service != null) {
            final RegisteredService rService = this.servicesManager.findServiceBy(new SimpleWebApplicationServiceImpl(service));

            if (rService != null && rService.isEnabled()) {
                context.getFlowScope().put("logoutRedirectUrl", service);
            }
        }

        // there are some front services to logout, perform front SLO
        if (needFrontSlo) {
            return new Event(this, FRONT_EVENT);
        } else {
            // otherwise, finish the logout process
            return new Event(this, FINISH_EVENT);
        }
    }

1.從FlowScope中讀取引數“logoutRequests”值

2.如果LogoutRequest列表不為空，則遍歷列表，檢查每個LogoutRequest的狀態是否為LogoutRequestStatus.NOT_ATTEMPTED，如果是，則說明還有服務未能關閉，需要再次嘗試關閉

3.如果允許重定向且請求中service引數不為空，且該服務對應的RegisteredService中有註冊，則將service引數值儲存到FlowScope中的"logoutRedirectUrl"

4.返回Event