PingOne Platform APIs

Logout Settings

The Logout Settings service enables or disables single logout (SLO) for applications using OIDC, SAML, and WS-Federation protocols.

Logout settings data model

Property Type Required? Mutable? Description

environment.id

String

N/A

Read-only

The environment associated with the application.

enableCrossProtocolSLO

Boolean

Optional

Mutable

Enables or disables cross protocol single logout (SLO). Defaults to false. If enabled, and PingOne receives one of the following supported protocol logout requests:

  • An OpenID Connect (OIDC) relying party (RP)-initiated logout at {{authPath}}/{{envID}}/as/signoff

  • A WS-Federation wa=wsignout1.0 request at /wsf/prp/{appID}

  • A SAML 2.0 SLO request from a SAML application at /saml20/idp/slo

  • A SAML 2.0 SLO request from a SAML IdP at /saml20/sp/slo

  • An HTTP GET request at /saml20/startslo

PingOne sends the following logout requests to applications and IdPs associated with the same session:

  • OIDC front-channel logout requests to OIDC-based applications

  • WS-Federation wa=wsignoutcleanup1.0 cleanup requests to WS-FED applications

  • SAML 2.0 SLO to and from SAML applications

  • SAML 2.0 SLO to and from SAML IdPs

PingOne sends asynchronous OIDC and WS-Federation logout messages first, followed by SAML 2.0 logout messages.

enableAltOidcPostLogoutUriValidation

Boolean

Optional

Mutable

When set to true, enables validation of the post_logout_redirect_uri parameter for Post Signoff (Cross-Protocol) against the values for the postLogoutRedirectUris property. This is applicable only when the request does not include the id_token_hint parameter or includes one, but without a valid ID token as its value. When enabled, PingOne uses these redirect URIs instead of the application’s signoff URLs.

When cross-protocol logout is enabled, this setting is automatically enabled and can’t be disabled.

postLogoutRedirectUris

String[]

Optional

Mutable

The URLs that the browser can be redirected to after logout. Each entry must be an absolute URL, and cannot contain a fragment component. Case-insensitive matching is used to determine whether the URI in the request is allowed. Wildcards are not accepted.

PingOne always validates post_logout_redirect_uri values against this list for requests sent to {{authPath}}/{{envID}}/as/signoff and /saml20/startslo. If there is no match, PingOne aborts the logout requests.

If enableAltOidcPostLogoutUriValidation is enabled, the post_logout_redirect_uri value must match one of these URLs exactly when:

  • The OIDC RP-initiated request does not include the id_token_hint parameter or includes one without a valid ID token as its value.

  • The the request includes the post_logout_redirect_uri parameter.

For WS-Federation sign-off requests to /wsf/prp/<appId>, PingOne always validates the wreply value against this list. If there is no match, PingOne aborts the logout requests.