The discussion revolves around implementing Single Sign-Out (SSO) with Discourse. Amethi initially inquired about the capability, and itsbhanusharma suggested using the Logout redirect feature to set the IDP logout link.
Another user, toondaey, implemented SSO but faced issues with redirecting to the logout link after logging out of Discourse. itsbhanusharma and toondaey discussed the setup, and it was determined that the logout redirect link was not set.
Even after setting the logout redirect, toondaey encountered issues with user session expiration on their website. itsbhanusharma suggested that the session expiration is not directly related to Discourse and proposed two potential solutions: sending a signal to Discourse using the API or reducing the Discourse session time to provide a leeway for sessions to close after inactivity.
I’ve just implemented Discourse SSO (to my Identity Server 4 powered IDP, yay).
I take it there’s no single-sign-out capability, i.e. a ping to the IDP to let it know the user has signed-out, so they can be signed-out of the IDP and any other apps as well?
The situation where someone uses a public computer, signs-in to the IDP, uses Discourse, then signs-out of Discourse thinking they’re done, when actually they’re stilled signed-in with the IDP, which would allow anyone using the computer next to just click Sign-in to Discourse again and be authenticated without prompt concerns me.
Hi, I just implemented too. But it doesn’t redirect to the logout link for my website. Just logs out of discourse and attempts to login again.
Is there anyway I can force it to redirect or trigger an event that will log the user out of the other site?
Thanks.
I followed to the letter, every instruction in this post: Official Single-Sign-On for Discourse (sso) i.e. setup the sso login url, receive the payload and secret, verify the secret, create a url encoded base64 payload and hashed payload which was received on the forum and automatically logs on the user.
However, the user is not logged off the website when I log out of discourse as well as when the user session on the main site expires.
You will have to do something to send discourse a signal that the user session is expired maybe you can try tinkering with API ..
Other way I can think of is to reduce the discourse session time. This won’t actually sync logout on both platforms but will provide a leeway for sessions to be closed if a user is inactive for more than given time.