Dan NK.71664 (Customer) asked a question.
Hello,
I have been implementing Okta Auth with many applications via Single Sign On.
We have noticed there is an issue with logging out of Okta/Applications.
First and foremost, when a user logs out of their Okta Session via the Okta Platform they are still authorized in the corresponding applications until the refresh token expires.
Ideally the user is supposed to be logged out of every application on the browser and the tokens revoked. I have followed documentation for SLO here:
I followed the documentation with two of my OIDC Angular applications. I have noticed that when both applications are logged into the browser, and I redirect to the logout url from the application, I do not log out of the Okta session and the applications. But when there is a single application authorized in the browser it does log out of both the application and the user session.
But I have not been able to deauthorize all application sessions from signing off from the Okta platform itself. This is a very important feature which I believe should be the default behavior. Once an Okta user session is ended all application sessions associated with that user should be ended as well.
I would appreciate support to debug this issue and find appropriate options.
@Dan NK.71664 (Customer), thank you for providing details of the issue. One of our product experts will reply soon to help troubleshoot further.
@Dan NK.71664 (Customer) - OAuth2 is an authorization protocol and does not define a SLO standard.
In the case of how OIDC applications handle a session after a user logins is independent. Some will use the expiry time from the access/id token, while others use their own session management logic.
The Okta SLO option with an OIDC application will log the user out of the browser application (potentially multiple apps if session storage is being used), and log the user out of their Okta session.
From https://help.okta.com/en/prod/Content/Topics/Apps/Apps_Single_Logout.htm
If you have an application that can act as a management application (can secure an API Token), then on logout your application could call clear user sessions and pass the option to include access/refresh tokens. This would invalidate all the users tokens. However if some integrated applications don't rely on these tokens after login, this would have no effect.
Other applications that use an access/refresh token would not know the user is logged out until attempting to use the refresh or access token.