OpenID Connect Single Logout

Following are the three SLO mechanisms supported by OIDC: 

OIDC Session Management

This mechanism enables defining how to monitor the user's login status at the identity provider's end so that the client application can automatically log out the user who is logged out from the identity provider.

As per the OIDC session management specification, WSO2 Identity Server enables an application to monitor login status of an end user against the identity provider so that the RP can log out any end users that have logged out of the identity provider. For example, suppose there are two RPs relying on the identity provider, when an end user logs out of one of the applications, the user will be automatically logged out of the other RP. In this logout mechanism, front-channel  communication is used to communicate the request messages.

Endpoint discovery

To enable OIDC session management, the RP needs to obtain the following OP endpoint URLs: 

OP logout endpoint URL

• When a user is logged out from the RP, the RP redirects to the OP's logout endpoint URL to log out the user at the OP.

• The logout endpoint URL can be discovered using the end_session_endpoint parameter in the OIDC Discovery response.

• The logout endpoint URL is in the following format.

  Format

  https://<PRODUCT_HOST>:<PRODUCT_PORT>/oidc/logout

  Example

  https://localhost:9443/oidc/logout

• The logout request sent by the RP to OP includes the following query parameters.

OP iframe URL

• The RP may rely on the ID token that comes with an expiration date to expire the RP session. In case the user logs out of OP prior to token expiration, there should be a mechanism for user login status verification at the OP. For this, once the session is established with the authentication request and response the login status at the OP is verified by polling a hidden OP iframe from an RP iframe.

• The OP iframe URL is the URL of the OP iframe that supports cross-origin communications for session state information with the RP, using the HTML5 postMessage API. The page is loaded from an invisible iframe that is embedded in an RP page enabling it to run the OP's security context. The OP iframe URL accepts postMessage requests from the relevant RP iframe and uses postMessage to post back the user login status at the OP.

• The OP iframe URL can be discoverd using the check_session_iframe parameter in the OIDC Discovery response.

• The OP iframe URL is in the following format.

  Format

  https://<PRODUCT_HOST>:<PRODUCT_PORT>/oidc/checksession

  Example

  https://localhost:9443/oidc/checksession

• The RP should request the page from the OP iframe URL with the following query parameter.

OIDC session management works with two hidden iframes, one at the RP and the other at identity provider. The RP checks the session state by using the RP iframe to continuously poll a hidden identity provider iframe, without causing network traffic. Thereby, the RP is notified when the session state of the end user has changed. The flow of this is as follows. 

How it works

1. The RP iframe polls the identity provider iframe for a session status. 

2. The identity provider iframe sends back a post message about the session state as changed, unchanged or error. 

3. If the session state is changed, the RP sends a passive request for re-authentication. 

4. If the end user has logged out from the identity provider, the RP will receive an authentication failure message along with a new session state value. The RP handles this as an end user logout. 

5. If the end user has not logged out, the RP will receive a successful authentication response along with a new session state value. 

Configurations

You can configure an RP for OIDC session management in WSO2 Identity Server with either of the following methods:

• OpenID Connect Dynamic Client Registration

• Manual configuration through WSO2 Identity Server Management Console

Follow the steps below to configure an RP for OIDC session management in WSO2 Identity Server Management Console:

1. Sign in to the WSO2 Identity Server Management Console.

2. To register a web application as a service provider:

   1. On the Main menu, click Identity > Service Providers > Add. 
      

   2. Enter the name of the application in the Service Provider Name text box.
      

   3. Click Register. Note that you will be redirected to the Service Providers screen.

   4. To sign the ID token with the user's tenant domain, in the Local & Outbound Authentication Configuration section, select Use tenant domain in local subject identifier check box. 

      Open

      

   5. In the Inbound Authentication Configuration section, click OAuth/OpenID Connect Configuration > Configure.
      

   6. Enter the callback URL as given below.
      

   7. Click Add. Note that a client ID and client secret have been created.
      

      
      You have successfully added the service provider. Similarly, register another service provider to test single logout.

3. To view the identity provider's logout endpoint URL, which gets called when the logout is triggered from the service provider:

   1. On the Main menu, click Identity > Identity Providers > Resident.
      

   2. Under Inbound Authentication Configuration, click OAuth2/OpenID Connect Configuration.
      

      
      Note that the identity provider's logout endpoint URL is listed out.