End local and federated sessions deliberately.
OpenID Connect supports coordinated logout patterns, but an application session, an identity-provider session, and sessions at other applications are separate things. Ending one does not automatically end all of them.
Why this lesson?
A user signs out of one enterprise application and expects the application and, when supported, the shared OpenID Provider session to end without leaving unrelated local sessions ambiguous.
Learning goal and prerequisites
End the local application session
The user chooses sign out in the application. The relying party clears its own local session first so that this application no longer treats the browser as signed in, even if a broader identity-provider session still exists.
Inspect request, response, and claims
Try a failure scenario
↳ Change a condition
Read the detailed explanation
Why it exists, how it works, and where it fits
Signing a user out sounds simple until several sessions exist at the same time. The application may have its own session cookie, the identity provider may have a separate single sign-on session, and other applications may also have sessions created from that provider. Ending one of those sessions does not automatically end the others.
OpenID Connect defines logout patterns that help coordinate session termination. An application can clear its own local session and, when appropriate, ask the identity provider to end or notify other relying parties about related sessions. Different deployments may use front-channel, back-channel, or relying-party initiated logout mechanisms.
The important security goal is to be explicit about which session is being ended. Clearing only the local cookie signs the user out of one application but may allow immediate single sign-on again because the identity-provider session still exists. Ending the provider session may affect several applications.
Logout also does not automatically revoke every access or refresh token. Token lifetime and revocation are separate controls. A complete design decides what should happen to the local session, the provider session, and any outstanding tokens when the user chooses to sign out or an administrator terminates access.
Investigation
Inspect the traffic, select a diagnosis in the checkpoint, then reveal the repair.
Check your understanding
Pass the lesson quiz
Answer every question correctly to unlock the next lesson. Retry as often as you need.