User sign out flow (local app)

Identity Engine

This guide covers the use case to sign a user out, and provides a flow diagram and a sequence of integration steps.

---

Learning outcomes

Understand how to implement a sign-out flow for a user.

What you need

• An app that uses the embedded Okta Identity Engine SDK
• Okta org already set up for your use case
• Identity Engine SDK set up for your own app

Sample code

Java Identity Engine sample app (opens new window)

---

Configuration updates

There are no additional configuration changes needed to implement this use case.

Summary of steps

This use case signs a user out of the local app by revoking their session tokens.

Integration steps

Create a sign-out UI element

The first step is to create a link, button, or other similar UI element that allows the user to sign out of the app.

Revoke the access token

When the sign-out request is initiated, create the following flow:

1. Obtain the access token from the active session state.

2. Call the IDXAuthenticationWrapper.revoketoken() method, passing in the access token obtained from the previous step.

3. Invalidate the current session.

   ...
    public String logout(final HttpSession session) {
        logger.info(":: Logout ::");

        // retrieve access token
        TokenResponse tokenResponse =
                (TokenResponse) session.getAttribute("tokenResponse");

        if (tokenResponse != null) {
            String accessToken = tokenResponse.getAccessToken();
            // revoke access token
            logger.info("Revoking access token");
            idxAuthenticationWrapper.revokeToken(TokenType.ACCESS_TOKEN, accessToken);
        }

        // invalidate session
        session.invalidate();
        return "redirect:/";
    }
    ...

Send the user to the signed-out page

After the access token is revoked and the session is no longer valid, redirect the user to the signed-out page.

See also

• Validate SSO federation.