Your suggested change has been received. Thank you.

close
Thales Logo

All

  • All
  • CipherTrust Manager
  • CipherTrust Application Data Protection (CADP)
  • CipherTrust Application Key Management (CAKM)
  • CipherTrust Batch Data Transformation (BDT)
  • CipherTrust Cloud Key Management (CCKM)
  • CipherTrust Data Discovery and Classification (DDC)
  • CipherTrust Data Protection Gateway (DPG)
  • CipherTrust Database Protection (CDP)
  • CipherTrust Intelligent Protection (CIP)
  • CipherTrust Integrations
  • CipherTrust Migrations
  • CipherTrust RESTful Data Protection (CRDP)
  • CipherTrust Transparent Encryption (CTE)
  • CipherTrust Transparent Encryption Userspace (CTE-U)
  • CipherTrust Secrets Management (CSM)
  • CipherTrust Vaulted Tokenization (CT-V)
  • CipherTrust Vaultless Tokenization (CT-VL)
  • CTE-Linux
  • CTE-Windows
  • CTE-AIX
  • CTE-K8s
  • CTE-U
  • Crypto Command Center
  • Data Protection on Demand
  • Luna Cloud HSM
  • Luna Network HSM
  • Luna PCIe HSM
  • Luna USB HSM
  • OneWelcome Identity Platform
  • ProtectApp LUKS
  • ProtectServer 2 HSM
  • ProtectServer 3 HSM
  • SafeNet Trusted Access (STA)
  • SafeNet MobilePASS+
  • SafeNet MobilePASS+ for Android
  • SafeNet MobilePASS+ for Chrome
  • SafeNet MobilePASS+ for macOS
  • SafeNet MobilePASS+ for iOS
  • SafeNet MobilePASS+ for WatchOS
  • SafeNet MobilePASS+ for Windows
  • SafeNet Synchronization Agent
  • SafeNet Logging Agent
  • SafeNet Agent for FreeRADIUS
  • SafeNet Agent for NPS
  • SafeNet Agent for Windows Logon
  • SafeNet Authentication Service Private Cloud Edition (SAS PCE)
  • SafeNet Remote Logging Agent
  • SafeNet Keycloak Agent
  • SafeNet IDPrime Virtual (IDPV)
  • SafeNet FIDO Key Manager
  • SafeNet FIDO Key Manager for Android
  • SafeNet FIDO Key Manager for iOS
  • SafeNet FIDO Key Manager for Windows
back

iFrame session monitoring

End session API

search
printsuggest an editpdf paneldownload

End session API

This guide covers configuration and expected flows for the End Session API.

copy link to clipboardConfiguration

copy link to clipboardDelete tokens on logout

When enabled, this deletes any access tokens and refresh tokens for a session when the end-session endpoint is called. Use this setting when you use the PKCE client authentication method.

If a client enables SAML SLO and does not use refresh tokens, the tokens are removed regardless of this setting.

copy link to clipboardPost-logout redirect URIs

After hitting the end-session endpoint, you likely want your relying party (RP) to be redirected back to one of your own pages. You can configure one primary or default URI and many additional URIs that you allow the OP to redirect the RP to. When making a request to the endpoint, you can specify a post_logout_redirecturi as part of your request, but it must match one of the configured URLs in the OpenID Client configuration. If no URI is specified in the request, it falls back to the default or doesn't redirect at all if nothing is configured.

copy link to clipboardFront-channel logout support

The OneWelcome Identity Platform OP implementation also supports OpenID Connect Front-Channel Logout 1.0. You can configure a front-channel logout URI on the admin console. This URI is included in the end session HTML as an iFrame that executes a GET request toward a particular URI. This is most commonly used to help with single logout (SLO) in the relying party's apps.

copy link to clipboardFlow diagram

The flow diagram shows the RP logout and front channel with three RPs.

RP logout + Front Channel (3 Relying Parties)

The following steps occur only after the session has already been established at the RP and OP:

  1. The user wants to log out and clicks a logout link for an RP.

  2. The user agent triggers the end-session URL on the OP.

    It should be triggered with at least an id_token_hint and optionally a post_logout_redirect_uri. It should be included if the user agent wants to redirect to a specific URI after a successful logout.

  3. The OP invalidates its own session, which links to all three RPs in it.

  4. The OP generates a logout page that contains an iFrame for each RP that was in that particular session and returns it to the user agent.

  5. The user agent renders the logout page, which triggers requests to the RPs to invalidate the sessions. The RPs should have reachable URIs that trigger an end in the session on the RP.

  6. Each RP receives the request independently, destroys its own session, and cleans up cookies or storage.

  7. The user agent displays a successfully logged out page or is redirected to another page based on the post_logout_redirect_uri that was specified in step 1.

To see an example of the HTML, see the End session API.

On this page