Identity as a Service:Advanced: Single logout (SLO)

Call the SLO endpoint

To initiate a logout, first terminate the user's session in your application and then redirect the user to the application's logout endpoint provided by IDaaS.

An administrator can find the logout endpoint in the Application Settings section on the Application Details > Sign-In > Single Sign-on tab.

The logout endpoint URL is in the format https://{instance domain name}.aliyunidaas.com/login/app/{application ID}/oauth2/logout and logs the user out of the IDaaS main login session.

Redirecting a user to this endpoint initiates an SLO request. Because IDaaS cannot verify the source of the request at this stage, it prompts the user to confirm the logout action.

If an active IDaaS login session exists, IDaaS prompts the user to confirm the action by clicking Log Out.

If the user confirms the action, or if no active IDaaS login session exists, IDaaS displays a Logged out message.

Automatic redirect after logout

To redirect users to your application after logout instead of showing the IDaaS "Logged out" page, configure a logout callback URL. Specify this URL by using the post_logout_redirect_uri parameter.

An administrator must navigate to Applications > Manage > Sign-on > Single Sign-on, locate the Logout Redirect URIs setting, and enter the full callback URL for the application.

The Logout Redirect URIs field functions as an allowlist, and you can add up to five URLs. When a logout is initiated, the post_logout_redirect_uri value passed to the SLO endpoint must be in this allowlist.

The Logout Callback URLs setting is located in the Advanced Settings section. On the Single Sign-on configuration page, you must click Show Advanced Settings to expand the section before you can find and configure the setting.

After saving the configuration, you can pass the post_logout_redirect_uri parameter to the SLO endpoint to enable redirection after logout.

Automatic logout

For a seamless user experience, you can skip the manual confirmation step to log the user out and redirect them automatically. To enable this, you must configure the logout callback URLs as described previously and pass an additional parameter to the SLO endpoint: id_token_hint.

The SLO logout endpoint supports the following parameters:

Parameter	Required	Description
id_token_hint	No	Required to enable automatic logout. This parameter verifies the request's validity. Pass the id_token that was issued by IDaaS during SSO and corresponds to the most recent session, which means it has a matching session ID. Note If the sid (session ID) claim in the id_token does not match the most recent session for the application in IDaaS, the user must manually confirm the logout. Manual confirmation is not required even if the id_token is expired, as long as it corresponds to the most recent session. This is a security measure defined in the OIDC specification to prevent malicious logout attacks.
post_logout_redirect_uri	No	Required to enable automatic redirection after logout. The HTTPS callback URL to which IDaaS redirects the user after SLO completes. This URL must be configured in the application settings in IDaaS.
state	No	A random string. If automatic redirection is configured, IDaaS returns this value to the application as a callback parameter. Used for security validation.

The following example shows a request to the SLO endpoint:

GET https://example.aliyunidaas.com/login/app/<application_id>/oauth2/logout
	?id_token_hint=${id_token}
	&post_logout_redirect_uri=${post_logout_redirect_uri}
	&state=${state} 

SLO workflow

References

• OpenID Connect RP-Initiated Logout 1.0