RP-Initiated Logout in Identify OIDC

Overview

The Identity OIDC server supports RP-Initiated Logout. This allows a Relying Party (RP) - typically an application - to initiate a logout request and redirect the user to the Identity Provider (IdP) to terminate the session. The logout endpoint supports both GET and POST HTTP methods:

https://<your-identity-server>/runtime/openidconnect/logout.idp

Supported request parameters:

Parameter Required Description
client_id Optional The application's client ID.
id_token_hint Optional A previously issued ID Token for the current session, used to identify the user.
post_logout_redirect_uri Optional The URL to redirect the user to after logout. Must be pre-registered with the client.
state Optional A value to maintain state between the logout request and the callback. Returned in the response.

Example:

GET /runtime/openidconnect/logout.idp?id_token_hint=eyJhbGci...&post_logout_redirect_uri=https://app.example.com/logout/callback&state=abc123

Handling of parameters in the logout request

The OpenID Connect RP-Initiated Logout 1.0 specification defines several parameters that can be included in a logout request to the OP (Safewhere Identify), but none are strictly required by the specification itself. However, for security reasons, Identify must be able to determine which application initiated the logout request and which login session to terminate. Therefore, Identify requires that the request includes at least one of the following parameters: id_token_hint, client_id, or post_logout_redirect_uri. If all of these parameters are missing, Identify will return an invalid_request error response with the following message:

For security reasons, an OIDC RP-initiated logout request must include at least one of the following parameters: id_token_hint, client_id or post_logout_redirect_uri. This ensures that Identify can determine which application initiated the logout request.

According to the specification, if the id_token_hint is not provided, Identify will, by default, prompt the user to confirm the logout. To bypass this confirmation page, you can enable the setting Do not prompt the user when logging out without an ID token hint.

Note: This setting only affects the logout confirmation screen. It does not disable validation of the id_token_hint if it is included in the request. If id_token_hint is present, it will be used to validate the client_id and post_logout_redirect_uri parameters. These must match if provided.

Post-Logout Redirect

The logout request may include a post_logout_redirect_uri parameter, which is handled as follows:

  1. If the id_token_hint or client_id parameter exists (both can be present), they are used to identify the client application registered in Identify. The post_logout_redirect_uri parameter must match the configured OpenID Connect logout redirect URL setting for that client.
  2. If neither id_token_hint nor client_id is present, but post_logout_redirect_uri is provided, Identify attempts to match it to the configured OpenID Connect logout redirect URL of a registered client to identify the application.

In both cases, for a successful logout, the OpenID Connect logout redirect URL configured in the OIDC client settings is used to redirect the user back to the client application.

A typical successful logout flow is:

  1. The OIDC client application sends a logout request with valid parameters.
  2. Identify ends the user's session for the client application, identified using one of the following: client_id, id_token_hint, or post_logout_redirect_uri.
  3. The user is redirected to the OpenID Connect logout redirect URL registered in the OIDC client settings.
  4. If the state parameter was included in the original request, it is also included in the redirect.