OIDC Single Log Out

[flukic]

Hi experts,

we are currently in process of implementing the CDC as OP in a federated scenario.
Our client is interested if there is a possibility to perform the federated SLO in the OIDC case?
Some option where a user would be logged out across RPs.

Based on the available documentation it does not seem like it.
But would some workaround be possible to achieve this?
Would be interested any experiences going in this direction.

Thank you!

[igal_mi · Accepted solution]

Hi Filip,

When a users logs out on the OP (using socialize.logout endpoint), it invalidates all OIDC RP tokens that were created during this login session.

This means that when any RP will try to use an access token or a refresh token, it will get an error from CDC. This is the "event" to know that the OP session is no longer valid and that the user should be logged out of the RP as well.

Hope this answers the question.

Igal