Configure Single Logout

Identity Engine
Early Access

This guide discusses how to configure the Single Logout (SLO) feature for your

identity providers

.

---

Learning outcome

Understand the purpose of Single Logout (SLO) and set it up for your

identity providers

.

What you need

• Okta Integrator Free Plan org (opens new window)
• Existing

  OpenID Connect (OIDC) identity provider

  to update for SLO. See

  Create an OIDC identity provider

  if you don’t have one configured.

• The SLO and SLO for IdPs features enabled for your org. In the Admin Console, go to Settings > Features, locate Front-channel Single Logout and Front-channel Single Logout for IdPs, and enable them

  .

---

Overview

Single Logout for Identity Providers (SLO for IdPs) allows Okta to send sign-out requests to the IdP when a user signs out of your app.

Note: You must have the Single Logout feature enabled to then enable and use the Single Logout for IdPs feature.

The Single Logout feature allows a user to sign out of an SLO-participating app on their device and end their Okta session. The user is then automatically signed out of all other SLO-participating apps.

Single Logout for IdPs

There are also SLO use cases where Okta is the service provider for an external IdP. To terminate the session with the IdP, Okta must also send a sign-out request to the IdP. The SLO for IdPs feature supports this use case.

Okta acts as an app for the IdP and sends the sign-out request to the external IdP to end the session. This applies only to the IdP where the user has previously established a session. Requests are communicated from Okta to the IdP using front-channel logout, which means that the browser does the communicating.

Safety considerations

SLO for IdPs is especially useful in scenarios where users share computers or use public kiosks. A user may sign in to a computer portal, and then authenticate into multiple apps using an IdP.

Ideally, when the user wants to sign out, they sign out of every app and the IdP session ends. This keeps the next user from accessing their information. But, most users don’t sign out of their apps and IdPs, thus the IdP session is still active. SLO for IdPs signs the user out of all participating apps and IdPs.

SLO for IdPs

diagram

Event 1

• The user signs out of App 1 using the browser.

Event 2

• App 1 initiates the logout (SP-initiated) by sending a front-channel inbound logout request to Okta using the browser. For example:

  GET https://{yourOktaDomain}/oauth2/v1/logout?id_token_hint=<idToken>&post_logout_redirect_uri=<configuredPostLogoutRedirectUri>&state=<someState>

• Okta ends the Okta session. The user can still access Apps 2 and 3 within the scope of each app session.

Event 3

• Okta initiates the logout (SP-initiated) to end the session with the IdP.

• Okta also initiates the outbound logout request (IdP-initiated) to the downstream apps (Apps 2 and 3). For example:

  POST https://idp.example.com/slo/logout

  Note: This URL is whatever the slo.url is that you specify when you configure your IdP for SLO for IdPs.

• If a downstream app is a SAML app, the SAML app makes a POST or REDIRECT request to the Okta /app/{app}/{key}/slo/saml/callback endpoint in response to the Okta outbound logout request. The SAML logout response is included in the request body.

Configure

SLO for IdPs

SLO for IdPs supports OIDC IdPs. The following steps explain how to configure your IdP for SLO using the API.

Note: See Enable Single Logout for an Identity Provider (opens new window) to update your identity provider using the Admin Console.

1. Send a GET IdP request and copy the response body for use in the PUT request.

   GET https://{yourOktaDomain}/api/v1/idps/{idpID}

2. Update the response body by editing the protocol.endpoints object:

   • Add the following slo object:

     "slo": {
         "url": "http://idp.example.com/slo/logout"
     }
     

   • In the protocol.settings object, update the participateSlo property value to true.

   Example request

   The request is truncated for brevity.

   { ...
   "protocol": {
       "type": "OIDC",
       "endpoints": {
           "slo": {
               "url": "http://idp.example.com/slo/logout"
           },
           "authorization": {
               "url": "https://idp.example.com/authorize"
           },
           "token": {
               "url": "https://idp.example.com/token"
           },
           "userInfo": {
               "url": "https://idp.example.com/userinfo"
           },
           "jwks": {
               "url": "https://idp.example.com/keys"
           }
       },
       "settings": {
           "nameFormat": null,
           "participateSlo": true,
           "sendApplicationContext": false
       },
   }....
   }
   

3. Use the updated response body in a PUT request.

   PUT https://${yourOktaDomain}/api/v1/idps/${idpID}

   Example response

   The response is truncated for brevity.

   { ...
   "protocol": {
       "type": "OIDC",
       "endpoints": {
           "slo": {
               "url": "http://idp.example.com/slo/logout",
               "binding": "HTTP-REDIRECT"
           },
           "authorization": {
               "url": "https://idp.example.com/authorize",
               "binding": "HTTP-REDIRECT"
           },
           "token": {
               "url": "https://idp.example.com/token",
               "binding": "HTTP-POST"
           },
           "userInfo": {
               "url": "https://idp.example.com/userinfo",
               "binding": "HTTP-REDIRECT"
           },
           "jwks": {
               "url": "https://idp.example.com/keys",
               "binding": "HTTP-REDIRECT"
           }
       },
       "settings": {
           "nameFormat": null,
           "participateSlo": true,
           "sendApplicationContext": false
       },
   }....
   }
   

Events

After Okta initiates the outbound logout request to

upstream IdPs

, Okta includes the number of OIDC and SAML app and IdP logouts that occurred with SLO. Those numbers are found in the System Log event user.session.end under DebugData:

• TotalOidcLogoutRequests: Lists the total number of logout requests for OIDC apps and IdPs
• TotalSamlLogoutRequests: Lists the total number of logout requests for SAML apps and IdPs

See also

• Okta developer blog that explains an inbound Single Logout request using Spring Boot for an OIDC app (opens new window)
• Spring Boot offers a Spring Security SAML Extension (opens new window) that's configured for global logout.