79711771

Date: 2025-07-23 11:21:42
Score: 1
Natty:
Report link

OIDC/OAUTH itself can't do what you want it to do

What you're currently doing is called an 'Rp-initiated logout', see the spec: https://openid.net/specs/openid-connect-rpinitiated-1_0.html

This is where the Relying Party (your client) tries to log the user out on the OpenID Provider (OP, Microsoft in this case)

Such a logout must be done via redirecting the user to the OP's logout endpoint, where the user SHOULD be asked for confirmation on whether he really wants to be logged out. There's no way to do this silently since the user might disagree with being logged out.

Specific OPs might have extensions to allow it

Some OPs might offer additional ways to terminate sessions not covered by the specification. For example, if you used Keycloak as an OP, it provides a separate REST API that allows terminating a session with a DELETE request. There might also be specific admin panels, UIs, etc. to do this. However, this depends on your specific Identity Provider. I haven't been able to find any such API endpoint for Microsoft.

What about Backchannel logouts tho?

You might get confused by the mention of 'backchannel logouts' when searching information about this topic. However, a Backchannel logout is when the session is already terminated on the OP through whatever means and the OP then informs the RPs (the clients) to terminate the session via a backchannel, not the other way around.

Reasons:
  • Long answer (-1):
  • No code block (0.5):
  • Contains question mark (0.5):
  • Low reputation (1):
Posted by: user25718310