Introduction

Once you log in to the application using an external provider, you are authenticated in both CoreOne Suite and the external provider.

When you log out, you are only logged out of CoreOne Suite. The decision of whether to also log out from the external provider is up to you as there are valid arguments both for and against doing so.

Setup

To enable the logout from external logon providers enable the useiframelogoutwithidtokenhint setting in the external logon provider configuration (servicecorelogin_external_logon_provider)

You can see useiframelogoutwithidtokenhint is set to true (line 7). This has to be set for the logout to work.

{
   "clientid": "cos",
   "clientsecret": "0lLM43yeXPKtBzyH7s3p5mKzWGS1dLVT",
   "authority": "https://idp.externalprovider.com",
   "useuserinfoendpoint": true,
   "requirehttpsmetadata": false,
   "useiframelogoutwithidtokenhint":true
 }

The logout from the external logon provider is done by invoking an IFrame on the logout page, so please check that you have the appropriate logout URL added to the trusted_address setting, otherwise CSP will block the request.

How it works

Login

During authentication to external provider the id_token will be saved to CoreOne Suite cache. The reference to the token will be saved in cookie external_id_token_ref_{auth_scheme}(for multiple browser scenario).

Logout

Based on the cookie, the id_token is retrieved from the cache.

On the logout page the iFrame is rendered with logout request to external provider. It should contain id_token_hint.

Cleanup

During logout we remove id_token that was used as it is not needed anymore. There will be situations when these tokens won’t be removed as no logout was invoked (like when browser simply closed). That means there will be obsolete id_tokens hanging in our cache.

To clean them up there is a process that you can set up using 131, 132 settings Settings .