Single Logout (SLO) permits users to sign out from both an application and Okta simultaneously. Administrators must understand the key aspects and constraints of SLO, such as Service Provider-Initiated (SP-Initiated) requirements and multiple device capabilities, to configure the feature successfully.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Single Logout (SLO)
• Identity Provider (IdP)
• Service Provider (SP)

What are the key considerations for Single Logout with Okta?

Review the following requirements and capabilities to understand how Okta handles Single Logout requests and multiple device sessions.

• Okta primarily supports Service Provider-Initiated (SP-Initiated) SLO, where the application initiates the logout process by sending an SLO request to Okta. This is the standard method to begin a logout sequence with Okta.
• Okta extends the logout to other applications by using the multiple device SLO feature. Okta initiates logout requests to other participating applications after receiving the initial SP-initiated logout.
• The Service Provider (SP) must sign the logout requests that it sends to Okta and adhere to relevant sections of the Security Assertion Markup Language (SAML) 2.0 specification.
• SLO facilitates logging out of multiple applications within a user session when administrators configure it properly. This depends on the SLO capabilities of the individual applications and the specific Okta SLO configuration.

Related References