Overview
ISO/IEC 26134:2024 - "Information technology - OpenID Connect - OpenID Connect RP‑initiated logout 1.0" standardizes a mechanism for a Relying Party (RP) to request that an OpenID Provider (OP) log out an End‑User. Built on OpenID Connect 1.0 and OAuth 2.0, this specification defines the logout endpoint, request parameters, discovery and dynamic registration metadata, validation rules, and security considerations for RP‑initiated logout flows.
Key Topics and Requirements
- Logout Endpoint (end_session_endpoint): OPs MUST publish the logout endpoint in discovery metadata. RPs redirect the End‑User's User Agent to this URL to request logout.
- Supported methods: OPs MUST accept both HTTP GET and POST at the logout endpoint; RPs MAY use either.
- Request parameters (defined, recommended, or optional):
- id_token_hint (RECOMMENDED): ID Token previously issued to the RP used to identify the End‑User session; OP MUST validate issuer and related session claims.
- logout_hint (OPTIONAL): OP‑specific hint (email, username, session id) to help locate the session.
- client_id (OPTIONAL): Used when id_token_hint is absent or for symmetric-decryption scenarios; OP must verify it matches the ID Token when both present.
- post_logout_redirect_uri (OPTIONAL): Registered URI for post‑logout redirection; OP MUST only redirect to registered values and SHOULD require id_token_hint or another confirmation of legitimacy.
- state, ui_locales (OPTIONAL): For maintaining state and UI language preferences.
- Validation & error handling: Failed validations must abort operations; OP MUST not perform post‑logout redirection on invalid requests.
- Logout notifications: OPs notify RPs logged in as the End‑User using session management, front‑channel, and/or back‑channel logout mechanisms before performing post‑logout redirection.
- Security: OPs SHOULD request explicit End‑User confirmation when id_token_hint is missing to mitigate denial‑of‑service and spoofing risks.
Applications and Who Uses It
- Identity providers (IdPs) / OpenID Providers: implement logout endpoint, discovery metadata, and notification mechanisms.
- Application developers / Relying Parties: integrate RP‑initiated logout to provide seamless single‑sign‑out experiences across web and native apps.
- SSO architects and security engineers: design end‑to‑end logout flows, ensure session invalidation, and manage post‑logout redirects securely.
- Compliance and product teams: adopt standardized interoperability for federated logout in enterprise SSO, mobile apps, and federated APIs.
Related Standards
- OpenID Connect Core 1.0 (identity layer on OAuth 2.0)
- OpenID Connect Discovery, Dynamic Client Registration
- OpenID Connect Session Management, Front‑Channel Logout, Back‑Channel Logout
- OAuth 2.0 (RFC 6749)
Keywords: OpenID Connect, RP‑initiated logout, OAuth 2.0, end_session_endpoint, id_token_hint, post_logout_redirect_uri, session management, OpenID Provider, Relying Party.