<samlp:LogoutRequest ID="[RANDOM ID]" Version="2.0" IssueInstant="[CURRENT DATE/TIME]">
<saml:NameID>@NOT_USED@</saml:NameID>
<samlp:SessionIndex>[SESSION IDENTIFIER]</samlp:SessionIndex>
</samlp:LogoutRequest>

<filter>
<filter-name>CAS Single Sign Out Filter</filter-name>
<filter-class>org.jasig.cas.client.session.SingleSignOutFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>CAS Single Sign Out Filter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<listener>
<listener-class>org.jasig.cas.client.session.SingleSignOutHttpSessionListener</listener-class>
</listener>

public void doFilter(final ServletRequest servletRequest, final ServletResponse servletResponse, final FilterChain      filterChain) throws IOException, ServletException {final HttpServletRequest request = (HttpServletRequest) servletRequest;if ("POST".equals(request.getMethod())) {final String logoutRequest = request.getParameter("logoutRequest");if (CommonUtils.isNotBlank(logoutRequest)) {if (log.isTraceEnabled()) {log.trace ("Logout request=[" + logoutRequest + "]");}//从xml中解析 SessionIndex key值final String sessionIdentifier = XmlUtils.getTextForElement(logoutRequest, "SessionIndex");if (CommonUtils.isNotBlank(sessionIdentifier)) {//根据sessionId取得session对象final HttpSession session = SESSION_MAPPING_STORAGE.removeSessionByMappingId(sessionIdentifier);if (session != null) {String sessionID = session.getId();if (log.isDebugEnabled()) {log.debug ("Invalidating session [" + sessionID + "] for ST [" + sessionIdentifier + "]");}try {//让session失效
                             session.invalidate();} catch (final IllegalStateException e) {log.debug(e,e);}}return;}}} else {//get方式 表示登录，把session对象放到SESSION_MAPPING_STORAGE(map对象中)final String artifact = request.getParameter(this.artifactParameterName);final HttpSession session = request.getSession();if (log.isDebugEnabled() && session != null) {log.debug("Storing session identifier for " + session.getId());}if (CommonUtils.isNotBlank(artifact)) {SESSION_MAPPING_STORAGE.addSessionById(artifact, session);}}filterChain.doFilter(servletRequest, servletResponse);}

public final class SingleSignOutHttpSessionListener implements HttpSessionListener {private Log log = LogFactory.getLog(getClass());private SessionMappingStorage SESSION_MAPPING_STORAGE;public void sessionCreated(final HttpSessionEvent event) {// nothing to do at the moment
      }//session销毁时public void sessionDestroyed(final HttpSessionEvent event) {if (SESSION_MAPPING_STORAGE == null) {//如果为空，创建一个sessionMappingStorage 对象SESSION_MAPPING_STORAGE = getSessionMappingStorage();}final HttpSession session = event.getSession();//取得当然要销毁的session对象if (log.isDebugEnabled()) {log.debug("Removing HttpSession: " + session.getId());}//从SESSION_MAPPING_STORAGE map根据sessionId移去session对象
         SESSION_MAPPING_STORAGE.removeBySessionById(session.getId());}/*** Obtains a {@link SessionMappingStorage} object. Assumes this method will always return the same* instance of the object.  It assumes this because it generally lazily calls the method.* * @return the SessionMappingStorage*/protected static SessionMappingStorage getSessionMappingStorage() {return SingleSignOutFilter.getSessionMappingStorage();}}

<!-- CentralAuthenticationService --><bean id="centralAuthenticationService" class="org.jasig.cas.CentralAuthenticationServiceImpl"p:ticketGrantingTicketExpirationPolicy-ref="grantingTicketExpirationPolicy"p:serviceTicketExpirationPolicy-ref="serviceTicketExpirationPolicy"p:authenticationManager-ref="authenticationManager"p:ticketGrantingTicketUniqueTicketIdGenerator-ref="ticketGrantingTicketUniqueIdGenerator"p:ticketRegistry-ref="ticketRegistry"p:servicesManager-ref="servicesManager"p:persistentIdGenerator-ref="persistentIdGenerator"p:uniqueTicketIdGeneratorsForService-ref="uniqueIdGeneratorsMap" />

<util:map id="uniqueIdGeneratorsMap"><entrykey="org.jasig.cas.authentication.principal.SimpleWebApplicationServiceImpl"value-ref="serviceTicketUniqueIdGenerator" /><entrykey="org.jasig.cas.support.openid.authentication.principal.OpenIdService"value-ref="serviceTicketUniqueIdGenerator" /><entrykey="org.jasig.cas.authentication.principal.SamlService"value-ref="samlServiceTicketUniqueIdGenerator" /><entrykey="org.jasig.cas.authentication.principal.GoogleAccountsService"value-ref="serviceTicketUniqueIdGenerator" /></util:map>

//创建 TicketGrantingTicketImpl 实例final TicketGrantingTicket ticketGrantingTicket = new TicketGrantingTicketImpl(this.ticketGrantingTicketUniqueTicketIdGenerator.getNewTicketId(TicketGrantingTicket.PREFIX),authentication, this.ticketGrantingTicketExpirationPolicy);//并把该对象保存到 ticketRegistry中this.ticketRegistry.addTicket(ticketGrantingTicket);

public void destroyTicketGrantingTicket(final String ticketGrantingTicketId) {Assert.notNull(ticketGrantingTicketId);if (log.isDebugEnabled()) {log.debug("Removing ticket [" + ticketGrantingTicketId+ "] from registry.");}//从 ticketRegistry对象中，取得TicketGrantingTicket对象final TicketGrantingTicket ticket = (TicketGrantingTicket) this.ticketRegistry.getTicket(ticketGrantingTicketId, TicketGrantingTicket.class);if (ticket == null) {return;}if (log.isDebugEnabled()) {log.debug("Ticket found.  Expiring and then deleting.");}ticket.expire();//调用expire()方法，让ticket过期失效this.ticketRegistry.deleteTicket(ticketGrantingTicketId);//从ticketRegistry中删除的ticket 对象}

public synchronized void expire() {this.expired.set(true);logOutOfServices();}private void logOutOfServices() {for (final Entry<String, Service> entry : this.services.entrySet()) {entry.getValue().logOutOfService(entry.getKey());}}

public synchronized boolean logOutOfService(final String sessionIdentifier) {if (this.loggedOutAlready) {return true;}LOG.debug("Sending logout request for: " + getId());//组装 logoutRequest参数内容final String logoutRequest = "<samlp:LogoutRequest xmlns:samlp=\"urn:oasis:names:tc:SAML:.:protocol\" ID=\""+ GENERATOR.getNewTicketId("LR")+ "\" Version=\".\" IssueInstant=\"" + SamlUtils.getCurrentDateAndTime()+ "\"><saml:NameID
 xmlns:saml=\"urn:oasis:names:tc:SAML:.:assertion\">@NOT_USED@</saml:NameID><samlp:SessionIndex>"+ sessionIdentifier + "</samlp:SessionIndex></samlp:LogoutRequest>";this.loggedOutAlready = true;//回调所有的application,getOriginalUrl()是取得回调的application urlif (this.httpClient != null) {return this.httpClient.sendMessageToEndPoint(getOriginalUrl(), logoutRequest);}return false;}