Skip to content

feat(oidc): RP-initiated and back-channel logout #409

Description

@Bccorb

Why

Signing out of Seamless Auth should sign users out of connected apps.

What

  • RP-initiated logout
  • Back-channel logout to registered clients

Done when

Logout propagates to connected clients and passes the logout conformance profiles.

Activity

  1. added this to the v0.21 milestone on Oct 13, 2026
  2. added
    P2GovRAMP readiness track
    secureServes the most-secure promise
    on Oct 13, 2026
  3. added theissue type on Oct 13, 2026
  4. Bccorb commented on Oct 30, 2026

    @Bccorb
    ContributorAuthor

    Architecture for this is settled in ADR 0001 (#520). The OpenID Provider runs in a separate public login edge (new repo, seamless-auth-oidc-provider) that signs users in through the first-party routes. The auth API stays private and cookie-free. See D3. RP-initiated logout is on the edge. The API sends back-channel logout when a linked session is revoked.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    P2GovRAMP readiness tracksecureServes the most-secure promisev0.21Targets the v0.21 release

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions