OIDC Back-Channel Logout Initiators

OIDC Back-Channel Logout Initiators allow you to remotely log out users from their applications based on session termination events. OIDC Back-Channel Logout Initiators work across protocols—for example, an identity provider-initiated (IdP-initiated) SAML logout request—and are unaffected by third-party cookie restrictions.

This feature is an extension to the standard OIDC back-channel specification. You can configure it to initiate an OIDC Back-Channel Logout request for specific session termination events, such as a password change or session expiration, or for all session termination events.

Administrators can enable this feature for specific applications with the Auth0 Management API.

Initiators bind an OIDC Back-Channel Logout response to a session termination event. They capture the event and use it to trigger an OIDC logout token in all applications associated with the given session.

The following diagram illustrates how an OIDC Back-Channel Logout Initiator works for a password change event:

You can configure OIDC Back-Channel Logout Initiators with the Auth0 Management API.

You can configure the OIDC Back-Channel Logout Initiators for an application with the Management API by using the Update a Client endpoint.

1. Get an Management API access token with the update:clients scope.

2. Call the Update a Client endpoint with the appropriate configuration data in the payload. For example, to log out an application after a password change event, provide the following:

   Log in to configure this snippet with your account

   PATCH /api/v2/clients/{yourClientId}
   {
     ...
     "oidc_logout": {
       "backchannel_logout_urls": ["https://example.com/cb"]
       "backchannel_logout_initiators": {
         "mode":"custom",
         "selected_initiators": ["rp-logout", "idp-logout", "password-changed"]
       }
     }
     ...
   }

   Was this helpful?

   Yes /No

The backchannel_logout_initiators object supports the following properties:

The mode property determines the configuration method for enabling initiators.

By default, it is set to custom, which allows you to specify which initiators you want to enable. If you want your application to logout anytime the IdP session ends, set it to all.

The mode property supports the following values:

The selected_initiators property contains the list of initiators to be enabled for the given application.

The selected_initiators property supports the following values:

PATCH /api/v2/clients/{yourClientId}

{
  ...
  "oidc_logout": {
    "backchannel_logout_urls": ["https://example.com/cb"]
    "backchannel_logout_initiators": {
      "mode":"all"
    }
  }
  ...
}

PATCH /api/v2/clients/{yourClientId}

{
  ...
  "oidc_logout": {
    "backchannel_logout_urls": ["https://example.com/cb"]
    "backchannel_logout_initiators": {
      "mode":"custom",
      "selected_initiators": ["rp-logout", "idp-logout", "password-changed"]
    }
  }
  ...
}

PATCH /api/v2/clients/{yourClientId}

{
  ...
  "oidc_logout": {
	  "backchannel_logout_urls": ["https://example.com/cb"]
  }
  ...
}