Loading
Prepare for Email to Become the Default Login ExperienceRead More
Intermittent freezing when using using certain browser versionsRead More
Secure Your Salesforce Org
Configure OpenID Connect Single Logout with Salesforce as the Relying Party

You are here:

  1. Salesforce Help
  2. Docs
  3. Secure Your Salesforce Org

Configure OpenID Connect Single Logout with Salesforce as the Relying Party

Configure single logout (SLO) for an authentication provider acting as the OpenID Connect provider. With OpenID Connect SLO, users can log out of either Salesforce or the OpenID Connect provider to log out of both of them.

Required Editions

Available in: both Salesforce Classic and Lightning Experience

Federated Authentication is available in: All Editions

Delegated Authentication is available in: Professional, Enterprise, Performance, Unlimited, Developer, and Database.com Editions

Authentication Providers are available in: Professional, Enterprise, Performance, Unlimited, and Developer Editions
User Permissions Needed
To view the settings: View Setup and Configuration
To edit the settings:

Customize Application

AND

Modify All Data

Before you configure OpenID Connect SLO, review this information.

  • Make sure that the authentication provider supports OpenID Connect SLO.
  • Salesforce currently supports front-channel SLO only, meaning that SLO redirects must occur in the same browser. Salesforce doesn’t support SLO across different browsers.
  • Some authentication providers don’t support logout initiated by the relying party. In this case, complete only step 5. Users can log out of Salesforce when initiated by the authentication provider. But logging out of Salesforce doesn’t necessarily log the user out of the authentication provider session.

These steps edit an existing Authentication Provider. The fields are the same when you create or manage a connected app.

  1. From Setup, use the Quick Find box to find and select Auth. Providers.
  2. Next to the auth provider that you want to configure for SLO, click Edit.
  3. Under Auth. Provider Edit, enter the logout endpoint from the authentication provider in Custom Logout URL. With this endpoint, Salesforce can initiate SLO. The Custom Logout URL must be an absolute URL and start with http:// or https://.
    Single Logout for OpenID Connect IdP
  4. Save your work.
  5. Provide the OpenID Connect provider with the SLO endpoint for your Salesforce org.

    The OpenID Connect provider uses this endpoint to initiate SLO. The endpoint has the format https://MyDomainName.my.salesforce.com/services/auth/idp/oidc/logout where MyDomainName is your Salesforce domain. You can also find this endpoint using the OpenID Connect Discovery Endpoint.

    Single Logout for OpenID Connect RP endpoint

See Also

 
Loading
Salesforce Help | Article