Key Elements and Limitations of Single Logout in Okta OIDC Applications
Last Updated:
Overview
The Single Logout (SLO) feature allows a user to sign out of an SLO-participating application on their device and end their Okta session. However, SLO does not automatically sign the user out of other active OpenID Connect (OIDC) applications. Okta initiates the sign-out request to the remaining applications, but each application must listen for the endpoint request and sign the user out independently.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Single Logout (SLO)
- OpenID Connect (OIDC) Applications
Solution
How does Single Logout function with multiple OpenID Connect applications?
When multiple OIDC applications participate in SLO and a user initiates a sign-out from one application, Okta signs the user out of that application and makes calls to the SLO endpoints of the remaining applications.
Review the following sequence of events to understand how Okta processes a Single Logout request across multiple OpenID Connect applications.
| App Name | Domain | SLO Endpoint |
| A | http://localhost:8080 | http://localhost:8080/slo/logout |
| B | http://localhost:8081 | http://localhost:8081/slo/logout |
| C | http://localhost:8082 | http://localhost:8082/slo/logout |
- A user signs in to all three applications and then initiates a sign-out from App A.
- Okta receives the sign-out and revoke endpoint requests and signs the user out of App A.
- Okta determines that App B and App C are part of the Okta session.
- Okta initiates a sign-out request to the SLO endpoints of App B and App C using an embedded iframe that remains invisible to the user.
Remaining applications require independent sign-out processing.
Okta does not automatically sign the user out of the remaining applications. Each application must listen for the endpoint request and independently sign the user out of the application.
