Okta Org2Org OIN App Does Not Show Front Channel Single Logout

The Okta Integration Network (OIN) Org2Org application does not currently support Front Channel Single Logout (SLO) because Okta only displays necessary configuration settings in the pre-configured application. To resolve this limitation, administrators must configure a custom SAML 2.0 app and an SAML IdP for the Org2Org connection, which allows SLO to be configured. 

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Integration Network (OIN)
• Security Assertion Markup Language (SAML)
• Single Logout (SLO)
• Custom SAML 2.0 Applications
• Org2Org

Okta pre-configures OIN applications to display only the settings necessary to complete the standard configuration. As a result, the standard OIN Org2Org application does not yet configure or display the SLO feature.

How is Single Logout configured for an Org2Org connection?

Create a custom SAML 2.0 application in the source organization, define the SAML Identity Provider in the target organization, establish the trust link, and configure the Single Logout settings by following these steps.

1. In the source organization, navigate to Applications > Create App Integration > SAML 2.0.
2. Enter placeholder URLs (for example, https://placeholder.okta.com) for the Single sign-on URL and Audience URI (SP Entity ID) to complete the initial setup.
3. Navigate to the Sign On tab of the application, copy the Identity Provider Single Sign-On URL and Identity Provider Issuer, and download the X.509 Certificate.
4. In the target organization, navigate to Security > Identity Providers > Add Identity Provider > Add SAML 2.0 IdP.
5. Enter the Identity Provider Single Sign-On URL and Identity Provider Issuer, and upload the X.509 Certificate gathered in the previous steps.
6. Save the configuration and copy the newly generated Audience URI and SAML Trust-Point ACS URL.
7. Return to the source organization and edit the SAML Settings of the custom application.
8. Replace the placeholder values with the copied values from the target organization:
   • Update the Single Sign-On URL with the SAML Trust-Point ACS URL.
   • Update the Audience URI (SP Entity ID) with the Audience URI.
9. Save the updates and assign the application to the appropriate users.
10. Edit the SAML application settings in the source organization, select Show Advanced Settings, and check the Allow application to initiate Single Logout box to enable SLO.
11. Enter the Single Logout URL and the SP Issuer, and upload the Signature Certificate used by the Service Provider (SP) to sign logout requests to define the SLO endpoints.
12. Save the changes.
13. Click View SAML setup instructions under the Sign On tab of the application to link the SP to the Okta SLO.
14. Copy the Identity Provider Single Logout URL and paste it into the SP configuration.
15. Log in to the SP via Okta, and then sign out of the SP to confirm that Okta securely signs out of both the SP and Okta.