Intermediate LevelAuthentication & Authorization
What is Single Logout (SLO) in SAML and OIDC and how are back-channel notifications sent?
❓ Interview Prompt: Explain Single Logout (SLO), Front-Channel vs Back-Channel Logout, Logout Tokens, and propagation across Service Providers.
When a user logs out of a central Identity Provider (IdP), Single Logout (SLO) guarantees that active sessions across all federated Service Providers (SPs) are terminated simultaneously.
Logout Mechanisms:
1
Front-Channel Logout: Uses browser iFrames or redirects to trigger logout URLs at each SP. Vulnerable if the user closes the browser mid-redirect.
2
Back-Channel Logout (OIDC / SAML):
•
The IdP sends direct server-to-server HTTP POST requests to every registered SP's logout endpoint.
•
Transmits a signed Logout Token (JWT containing 'sub' or 'sid' session ID).
•
SP backends invalidate matching local session records immediately without relying on browser redirects!
Code Implementation Example
typescript
// Back-Channel Logout HTTP POST payload verification
app.post('/api/auth/backchannel-logout', async (req, res) => {
const logoutToken = req.body.logout_token;
const claims = jwt.verify(logoutToken, IDP_PUBLIC_KEY) as { sub: string; sid: string };
// Destroy all active server sessions matching user ID or session ID
await db.sessions.destroy({ sid: claims.sid });
res.status(200).send('Logout Processed');
});💡Processing OIDC Back-Channel Logout POST notifications.
🎯 Interview Key Takeaway
Back-Channel Single Logout sends direct server-to-server HTTP notifications to invalidate sessions across federated service providers.
#Single Logout#SLO#Back-Channel#OIDC#Intermediate
Back to all Authentication & Authorization Questions→