Loading
Salesforce now sends email only from verified domains. Read More
Identify Your Users and Manage Access
Table of Contents
Filter by (0)Add
Select Filters

          No results
          No results
          Here are some search tips

          Check the spelling of your keywords.
          Use more general search terms.
          Select fewer filters to broaden your search.

            Search all of Salesforce Help
            Search all of Salesforce Help
            Configure OpenID Connect Single Logout with Salesforce as the Relying Party

            You are here:

            1. Salesforce Help
            2. Docs
            3. Identify Your Users and Manage Access

            Configure OpenID Connect Single Logout with Salesforce as the Relying Party

            Configure single logout (SLO) for an authentication provider acting as the OpenID Connect provider. With OpenID Connect SLO, users can log out of either Salesforce or the OpenID Connect provider to log out of both of them.

            Required Editions

            Available in: both Salesforce Classic and Lightning Experience

            Federated Authentication is available in: All Editions

            Delegated Authentication is available in: Professional, Enterprise, Performance, Unlimited, Developer, and Database.com Editions

            Authentication Providers are available in: Professional, Enterprise, Performance, Unlimited, and Developer Editions
            User Permissions Needed
            To view the settings: View Setup and Configuration
            To edit the settings:

            Customize Application

            AND

            Modify All Data

            Before you configure OpenID Connect SLO, review this information.

            • Make sure that the authentication provider supports OpenID Connect SLO.
            • Salesforce currently supports front-channel SLO only, meaning that SLO redirects must occur in the same browser. Salesforce doesn’t support SLO across different browsers.
            • Some authentication providers don’t support logout initiated by the relying party. In this case, complete only step 5. Users can log out of Salesforce when initiated by the authentication provider. But logging out of Salesforce doesn’t necessarily log the user out of the authentication provider session.

            These steps edit an existing Authentication Provider. The fields are the same when you create or manage a connected app.

            1. In Setup, in the Quick Find box, enter Auth. Providers, and then select Auth. Providers.
            2. Next to the auth provider that you want to configure for SLO, click Edit.
            3. Under Auth. Provider Edit, enter the logout endpoint from the authentication provider in Custom Logout URL. With this endpoint, Salesforce can initiate SLO. The Custom Logout URL must be an absolute URL and start with http:// or https://.
              Single Logout for OpenID Connect IdP
            4. Save your work.
            5. Provide the OpenID Connect provider with the SLO endpoint for your Salesforce org. The OpenID Connect provider uses this endpoint to initiate SLO. The endpoint has the format https://MyDomainName.my.salesforce.com/services/auth/idp/oidc/logout where MyDomainName is your Salesforce domain. You can also find this endpoint using the OpenID Connect Discovery Endpoint.
              Single Logout for OpenID Connect RP endpoint

            See Also

             
            Loading
            Salesforce Help | Article