What problem did you meet?
Logto currently does not support cascading (upstream) logout for Social and OIDC connectors.
We use Logto as a centralized identity broker for multiple applications and authenticate users through federated Identity Providers, including Gov.br (Brazil's national SSO platform). Gov.br requires applications to invoke its end_session_endpoint during logout.
Today, RP-Initiated Logout only terminates the local Logto session. Logto does not call the upstream provider's end_session_endpoint, does not expose the original upstream id_token, and does not provide hooks or lifecycle events that would allow this behavior to be implemented externally.
As a result, every client application would need to implement provider-specific logout logic, maintain access to the upstream id_token_hint, and register its own post-logout redirect URIs with each external IdP. This does not scale and undermines the role of Logto as a centralized federation layer.
Describe what you'd like Logto to have
Add support for optional cascading/federated logout for Social and OIDC connectors.
When RP-Initiated Logout is performed, Logto should be able to:
- Persist the upstream
id_token obtained during authentication (when provided by the upstream Identity Provider) and associate it with the Logto session.
- Detect whether the active session originated from a Social/OIDC connector.
- Invoke the connector's
end_session_endpoint using the stored id_token as id_token_hint.
- Complete the logout flow and redirect the user to the configured
post_logout_redirect_uri.
This functionality is particularly important when Logto is used as a centralized identity broker for multiple applications. Some upstream Identity Providers (e.g., Gov.br) have mandatory federated logout requirements, and delegating this responsibility to each client application is not scalable because applications do not have access to the original upstream id_token.
Providing native support for cascading logout would allow Logto to fully manage the authentication lifecycle across upstream and downstream identity providers.
What problem did you meet?
Logto currently does not support cascading (upstream) logout for Social and OIDC connectors.
We use Logto as a centralized identity broker for multiple applications and authenticate users through federated Identity Providers, including Gov.br (Brazil's national SSO platform). Gov.br requires applications to invoke its
end_session_endpointduring logout.Today, RP-Initiated Logout only terminates the local Logto session. Logto does not call the upstream provider's
end_session_endpoint, does not expose the original upstreamid_token, and does not provide hooks or lifecycle events that would allow this behavior to be implemented externally.As a result, every client application would need to implement provider-specific logout logic, maintain access to the upstream
id_token_hint, and register its ownpost-logout redirect URIswith each external IdP. This does not scale and undermines the role of Logto as a centralized federation layer.Describe what you'd like Logto to have
Add support for optional cascading/federated logout for Social and OIDC connectors.
When RP-Initiated Logout is performed, Logto should be able to:
id_tokenobtained during authentication (when provided by the upstream Identity Provider) and associate it with the Logto session.end_session_endpointusing the storedid_tokenasid_token_hint.post_logout_redirect_uri.This functionality is particularly important when Logto is used as a centralized identity broker for multiple applications. Some upstream Identity Providers (e.g., Gov.br) have mandatory federated logout requirements, and delegating this responsibility to each client application is not scalable because applications do not have access to the original upstream
id_token.Providing native support for cascading logout would allow Logto to fully manage the authentication lifecycle across upstream and downstream identity providers.