Identity as a Service:Advanced: Single logout (SLO)

Call the SLO endpoint

To initiate a logout, first end the session on the application side, and then redirect the user to the application logout endpoint provided by IDaaS.

An administrator can find the logout endpoint on the Application Details > Sign-In > Single Sign-on tab, in the Application Settings section below.

The logout endpoint URL is in the format https://{instance domain name}.aliyunidaas.com/login/app/{application ID}/oauth2/logout, and its description is "Logs the user out of the IDaaS main login session".

Redirecting the user to this endpoint initiates an SLO logout request. Because IDaaS cannot verify the validity of the request source at this point, you must confirm the logout.

If an IDaaS login session is active, IDaaS prompts you to Log Out of the current session and confirm the action.

If you confirmed the action in the previous step, or if no IDaaS login session exists, the Logged out message appears.

Automatic redirect after logout

If you prefer to return users directly to your application after SLO instead of showing the IDaaS "Logged out" page, configure the logout callback URL (that is, post_logout_redirect_uris).

An administrator must go to Applications > Manage > Sign-In > Single Sign-on configuration. Find the Logout Redirect URIs setting and enter the complete callback URL of the application.

Logout Redirect URIs is an allowlist that accepts up to five URLs. At logout, the post_logout_redirect_uris value that you pass to the SLO endpoint must be in this allowlist for the redirect to complete.

Logout callback URL is in the Advanced Settings expandable area. On the Single Sign-on configuration page, click Hide Advanced Settings to expand the area before you can find and configure this setting.

After you save the configuration, pass the post_logout_redirect_uris parameter to the SLO endpoint to redirect users after logout.

Automatic logout

You can skip the manual confirmation step to complete the logout and redirect automatically for a better user experience. In addition to the logout callback URL configuration described earlier, pass an additional parameter to the SLO endpoint: id_token_hint.

The SLO logout endpoint supports the following parameters:

Parameter	Required	Description
id_token_hint	No	Required to enable automatic logout. It verifies the validity of the logout request. Pass the id_token value that IDaaS issued during SSO and that corresponds to the most recent session (the session IDs match). Note If the sid claim in the id_token does not correspond to the most recent session of the application in IDaaS, you must confirm the logout manually. Even if the id_token has expired, manual confirmation is not required as long as it corresponds to the most recent session. This restriction is a security measure in the OIDC specification that prevents malicious logouts.
post_logout_redirect_uris	No	Required to enable automatic redirect after logout. Pass the HTTPS callback URL to which you want the user redirected after SLO. Configure this URL in the IDaaS application management settings in advance.
state	No	A random string. After you pass it to IDaaS, if automatic redirect is configured, IDaaS returns it to the application as a callback parameter. Used for security validation.

Example request to the SLO endpoint:

GET https://example.aliyunidaas.com/login/app/<application_id>/oauth2/logout
	?id_token_hint=${id_token}
	&post_logout_redirect_uri=${post_logout_redirect_uri}
	&state=${state} 

SLO workflow

References

• OpenID Connect RP-Initiated Logout 1.0