Service Provider (SP) initiated SLO when using OIDC (SaaS environment)
written-by
Madhusudan Sharma
How To articles are not official guidelines or officially supported documentation. They are community-contributed content and may not always reflect the latest updates to Liferay DXP. We welcome your feedback to improve How To articles!
While we make every effort to ensure this Knowledge Base is accurate, it may not always reflect the most recent updates or official guidelines.We appreciate your understanding and encourage you to reach out with any feedback or concerns.
legacy-article
learn-legacy-article-disclaimer-text
Issue
- We are utilizing OpenID Connect (AWS Cognito) for logging into Liferay; however, the users remain logged into the SSO system even after logging out of Liferay.
Resolution
- Currently Liferay's OpenID Connect (OIDC) implementation does not include SLO functionality. Hence, it would not be possible to configure Liferay to perform the SLO that automatically logs users out of both SP and IDP.
- However, it may be achieved if the Identity Provider can somehow trigger the token revoke. (Please note that this will be completely up to you as it will require configuration in your IDP)
- Furthermore, the Service Provider-initiated Single Log Out is supported by the SAML protocol, as a result, you might consider utilizing this.
did-this-article-resolve-your-issue