iwokc (iwokc) asked a question.
Unable to perform Single Logout in Okta Access Gateway
In the case of Okta Access Gateway, it is understood that if SLO (Single Logout) is enabled on the Okta Access Gateway side, the logout process should redirect to the SLO URL. However, based on the observation using SAMLtracer on the client side, it seems that the following SLO request is not being made:
https://[tenantID].okta.com/app/[tenantID]_[AppName]_1/[randomNumber]/slo/saml
The enabling of SLO itself should be in effect, and the Okta Access Gateway-specific logout page is also being displayed. What could be the possible causes for this issue?
Hi, @iwokc (iwokc)
Thank you for posting on our Community page!
Here is a helpful article for your use case:
https://support.okta.com/help/s/article/Application-logout-is-not-working-as-per-OAG-configuration?language=en_US
Thank you for reaching out to our Community and have a great day!
_____________________________________________________________________________
Community members help others by clicking Like or Select as Best on responses. Try it today.
_____________________________________________________________________________
@User16594883467582706479 (Customer Support Online Experience)
I don't think this is an article about single logout, because the transition destination after logout is different.
Also, I didn't see a menu for "Post Logout URL".
(If it's "Post Login URL" it will exist, but I don't think it matters.)
Just in case, option 1. I tried, but it didn't resolve.
What I'm asking is why a redirect to the SLO URL should have been done during single logout, but why isn't it?
Hello, @iwokc (iwokc)
I will suggest opening a case with Support so they can further inspect the issue, only if you are not seeing Okta session getting destroyed.
I don't see such a call in SAML Tracer when using OAG Single Logout either, but the Okta session is still properly destroyed. OAG must use some other mechanism to manage the Okta session, so I don't think you should fixate on looking for that call.
If Okta session is being properly logged out by OAG but you want to control the post logout URL, you will need to configure accordingly: https://help.okta.com/oag/en-us/Content/Topics/Access-Gateway/task-define-application-behaviors.htm#Logout