Problems and solutions for analyzing single sign-on (Flowchart and data security)

On a piece of my friends in accordance with the article: [Original] single sign-on (SSO) component design and implementation, according to their own understanding of a summary analysis: Analysis of single sign-on (flowchart and data security).

At that time according to the SSO process to do a personal analysis, but also get a lot of friends of the comments and help, but the pity is that no one of the garden friends to put forward my drawings of the problems in the flow chart. It may be that people do not see my picture (I am not).

At the time I thought there was not much of a problem with the process and the business logic, and when I talked to my friends about SSO, I was very proud of the SSO process and thought, and he was quite sure, but one of his questions stumped me.

His problem is this:

If User A is approved by the Certification center at the Federated site SiteA. This allows user A's user uid to appear in the list of lines in the Certification center. At this point, if user a reopened a federated subweb SiteB, how do you confirm the user's identity at the Federated site SiteB? Press

This user A should be logged in at the Federated Point SiteB.

To do this again, post your own understanding of the SSO flowchart and attach the three questions that bothered me on the diagram.

Follow the SSO login process (personal understanding):

First of all:

Determine if the session["UID" for this site exists, and if the session state exists for this site, it indicates that it is logged in.

Problem: Managing session state of subwebs by using sessions, it can effectively reduce the association between a child station and a federated site. But when the session of a subweb expires, this may be the case, and the session that exists in subweb A does not expire, but the sesion in subweb B is just expired , and the user does not pass the normal exit operation, at this time how to control the online list of certification Center? Is it existence or not?