Single Logout Considerations

Overview

Single Logout (SLO) considerations are specific to each implementation of the functionality. Ideally, the process for single logout would be the reverse process of single sign-on, but this unfortunately is not the case. When an IdP server receives a request for SLO, the logout service removes the user’s session from the application server and it redirects the user’s browser to the logout service defined in the IdP configuration.

An SLO request contains:

• A NameID that indicates the user is logged out.
• Optionally, a session index that corresponds to the optional attribute within the initial authentication statement.

An SLO response contains a status message that indicates whether the logout operation was successful.