axnlj (axnlj) asked a question.
Hi there,
I have an OKTA instance that I am using as an Identity Broker. With OIDC, this is pointing to a single IDP, which is pointing to another IDP. My app, the broker and the two IDPs are assigned sessions after signing in.
Now I would like to sign out of the application and clear all session cookies. I came across this:
https://help.okta.com/en/prod/Content/Topics/Apps/Apps_Single_Logout.htm
Okta doesn't sign out web applications.
Does this mean this our Identity Broker is capable of creating sessions but not capable of doing the reverse (removing them)? Perhaps this means OKTA cannot kill sessions in the back channel.
I also noticed Enable SLO for OIDC integrations. Could this post_logout_redirect_uri query string parameter be used to point to the first IDP in the chain (logout)?
Any help would be greatly appreciated. Thanks!
Hello @axnlj (axnlj),
While logged into Okta, its standard behavior is to auto-login any app/site that you have connected to it upon visiting.
One way to completely log out and stay that way would be to turn on single logout, which triggers when you log out of an app in Okta.
https://help.okta.com/en/prod/Content/Topics/Apps/Apps_Single_Logout.htm
Regards,
Natalia
Okta Inc.
Hi Natalia,
Thank you for getting back to me.
When a service provider (my app) signs out of the application, it is configured to sign out of a OKTA instance. This is working as expected.
However, I am having trouble with our OKTA instance sending a logout to other domains. OKTA is capable of sending the user to another Identity Provider (for example, Microsoft) to log in. However, I want to configure this instance to also sign out of the Identity Providers.
Logging into the application sets the session cookie in three domains:
[myapp.com] -> [OKTA] -> [Microsoft]
Signing out of myapp.com does not sign out the third domain:
[myapp.com]->[OKTA]-> [Microsoft]Although this makes signing into applications convenient, it's a significant security flaw. I would like a way to configure my OKTA instance (acting as a Identity Broker) to remove the session cookies it has created.
If this is not possible, could you disclose whether this is piece of functionality is on the road map?
Thanks again,
Damien