Two consecutive doorways connected by one continuous stone passage.

Product notes

The logout chain

A person signs in once, but more than one session is created along the way. Logout depends on ending the relevant sessions across that entire path.

One login. Three keys.

Say you add "Sign in with Google" to your service. To the user, that is one button press.

Underneath, every system on the path issues and stores its own session. Google holds one. Authrim holds one. Your app holds one. Three.

A surviving session may let the user keep working there, or sign in again without re-entering a password.

Logout is not printing "You have been signed out."
It means choosing the scope of logout and ending the sessions within that scope.

Token revocation is a separate matter

The "keys" here are sessions. Access tokens and refresh tokens are a different mechanism, and ending a session does not necessarily invalidate tokens already issued. Stopping a token requires revocation — a distinct operation.

In OIDC terms, session logout, token revocation and upstream account disablement are three different things. This installment covers only the session side. When a token stops working is covered in token introspection and revocation.

Authrim sits in the middle

In this connection, the upstream provider provides login and your application requests it. Authrim's role flips depending on which way it faces.

Upstream IdP Google, Entra ID, Apple Authrim your identity platform Your apps what users actually open asks for login = the customer (RP) provides login = the desk (OP) Roles invert top to bottom
Like a travel agency. To you it books the trip. To the airline it is a customer buying a seat. Authrim works both counters at once. That is what "in the middle" means.

Logout usually stops partway

Login flows downhill on its own. Logout does not travel unless someone carries it.

Ending an upstream session does not automatically remove sessions in Authrim or your application. Termination needs to be communicated downstream, and each receiver must end its matching session. The next diagram shows the chain when the required notification methods and configuration are in place.

CHAIN BROKEN Upstream IdP session ended no notice arrives Authrim key still live Your app key still live Result — they can still get in CHAIN INTACT Upstream IdP session ended "drop this user" signed notice Authrim collects, then relays down "drop this user" signed notice Your app collects Result — all three collected
The only difference is the middle arrow. Can Authrim receive the notice, and can it re-send it downstream. The upstream provider and each application must also support and configure the required methods for that chain to work.

What it looks like from the floor

SituationWhat a broken chain produces
Offboarding HR revokes access. The laptop still has the app open, and internal data stays visible until morning.
Shared terminals Retail, hospital, call center. The previous person signed out — then a second tab shows their dashboard.
Lost device "Sign out everywhere" was pressed. Only the session in hand actually ended.
Incident response You cut off the compromised user. The attacker's session runs to expiry anyway.
Audit "Demonstrate that logout propagates to all systems." Nothing to show.

None of these mean logout is missing. The button exists. The screen changes. The reach is narrower than anyone assumed — that is what makes it hard to catch.

The old delivery method is failing

There are two ways to tell downstream. One of them is breaking.

VIA THE BROWSER Authrim Browser hidden frames per app Your app Browser privacy protections block it. Tab closed means nothing arrives. SERVER TO SERVER Authrim signed notice, sent directly the browser is never involved Your app
The top method paints invisible frames to notify each app. Safari, Firefox and Chrome are progressively blocking those frames. Back-channel delivery is server to server, so it does not depend on browser state. It is not guaranteed to arrive, though: network failures, a receiver that is down, timeouts and 5xx responses all lose it. Retries, queueing and failure records are the implementation's responsibility.

Authrim's certification covers receiving the bottom method. Receiving a notice and sending it onward each need to be checked.

Checking both the receiver and the sender

Authrim acts as a relying party (RP) toward the upstream provider and an OpenID Provider (OP) toward applications. Carrying logout onward requires conformant behaviour in both roles.

  • As an RP: validate an upstream logout notice and end the matching Authrim session.
  • As an OP: send logout notices so that connected applications can end their matching sessions.

OP and RP logout profile certifications provide evidence for these two roles. Authrim holds logout profile certifications on both sides through the OpenID Foundation's self-certification process, using its official conformance tests.

Certification means the submitted implementation version passed the conformance tests for the submitted profiles. It does not guarantee immediate termination of every session across a customer's applications and network.

The upstream provider and each application must support the required methods, with notification endpoints and session mappings configured. Disabling an upstream account does not necessarily trigger a logout notice. Delivery failures, retries and failure visibility also need to be checked in the deployed configuration.

See the OpenID Foundation's Certified OpenID Relying Parties & Logout Profiles listing for certified versions and profiles, and its certification process for the scope of certification.

After logout, where does a signed-in session remain?

That is the question when handing a shared terminal to someone else or ending a former employee's access. Authrim handles both receiving and sending notices to connect session termination between the upstream provider and applications. Certification provides evidence about that implementation; testing the connected systems establishes whether logout reaches the intended scope.