Okta Front-Channel Single Logout (SLO) allows a user signing out of one participating Secure Assertion Markup Language (SAML) 2.0 or OpenID Connect (OIDC) application to automatically trigger sign-out requests to other active downstream applications in the same browser session. The user logging out of Okta or a Service Provider (SP) sends an SLO request to Okta, beginning the logout process. Enable this feature directly from the Okta Admin Console.

• Okta Identity Engine (OIE)
• Single Sign-On (SSO)
• Secure Assertion Markup Language (SAML)
• OpenID Connect (OIDC)
• Single Logout (SLO)

What are the steps to enable Front-Channel Single Logout in Okta?

Enable the Front-Channel Single Logout feature and the optional Identity Provider (IdP) setting by navigating to the Features section of the Okta Admin Console.

1. Sign in to the Okta Admin Console.
2. Go to Settings and select Features.
3. Locate Front-channel Single Logout and toggle it to Enabled.
4. If working with external Identity Providers, locate Front-channel Single Logout for IdPs and toggle it to Enabled.

NOTE: Okta supports the Front-Channel Single Logout feature only in Okta Identity Engine (OIE) and does not allow it to be enabled on Okta Classic Engine. Administrators must upgrade to OIE to utilize this functionality.

Related References

• Configure Single Logout
• Upgrade to Okta Identity Engine
• Identity Engine upgrade overview
• Schedule an Okta Identity Engine Upgrade Using Self-Service