4 ms·

Actually logout is not complicated. But openidconnect allows single-logout , which most of the time, you do not even need.

• mooreds 3y ago
  Logout across multiple systems is pretty complicated. You can do it with browser redirects, at least for now[0], but that relies on every system succeeding. What am I missing? 0: the fedcm work is going to impact redirects. https://github.com/fedidcg/FedCM/blob/main/explainer.md https://github.com/fedidcg/FedCM/blob/main/explainer.md
  • merb 3y ago
    The thing is, most of the time you don’t want single logout. You want to logout of the specific application, not from the idp and all rp‘s. Think about it, which user want to logout from your app and entra id and all the rp‘s? Probably only a few.
    • mooreds 3y ago
      Ah. In that case, I agree, it is relatively simple.
      • merb 3y ago
        It really depends what you are doing. If you control your own idp and you have multiple rp‘s you probably need it tough, but in this case a lot of things are hard, no matter if you use openid connect or nothing. Btw. even if you target entra id or other idp‘s it’s always a good idea to also have a way to trigger the single logout, some people might need it, so it is good to have it behind an Option. Also you should at least implement the backchannel logout. But as said none is really a requirement and often you just use an upfront idp as a second way to login and maintain your own user data in this case single logout is just an addon not a necessity.
• deleted 3y ago
  [deleted]