Understand logout behavior

Logout behavior depends on whether single logout (RP-initiated logout) is enabled for the identity provider. Single logout implements the OpenID Connect RP-Initiated Logout 1.0 specification.

Logout with single logout enabled

When single logout is enabled, the following sequence occurs:

  1. The user logs out of automation orchestrator.
  2. The local session is revoked and the refresh token cookie is cleared.
  3. The logout response includes a redirect_url pointing to the identity provider's end-session endpoint.
  4. The browser navigates to the identity provider to complete the logout.
  5. After the identity provider ends the session, the browser redirects to the post-logout URI.

If automation orchestrator cannot resolve the end-session endpoint, the response includes an auth_error field. The user is logged out of automation orchestrator but remains signed in at the identity provider.

Logout with single logout disabled

The user is logged out of automation orchestrator only. The session at the identity provider remains active.