When I log into my application with Salesforce as OpenID Connect Provider (OP), I am able to do so. But, when I try and log out of my application, I am logged out of Salesforce and then redirected to my Salesforce login page https://{MY_DOMAIN}.my.salesforce.com/.

Expected Behavior:

When a logout request with post_logout_redirect_uri is sent to OP, the OP should redirect to this URL after its own logout sequence.

Actual Behavior:

When I attempt to log out of the application I am redirected to my Salesforce domain and asked to log in to Salesforce again.

What I've Tried:

As per Documentation, I've enabled Single Logout on the connected app trying both https://{MY_KEYCLOAK_DOMAIN}/auth/realms/{REALM}/broker/{IDP}/endpoint/logout_response and https://{MY_KEYCLOAK_DOMAIN}/auth/realms/{REALM}/protocol/openid-connect/logout as the Single Logout URL value in the connected app configuration.

I've attempted using the back-channel logout method, but it does not seem to log out of Salesforce using that.


As you've discovered, only front-channel OIDC single logout (SLO) is supported by SF acting as OpenID Connect Provider (OP). This is/can be confirmed via OIDC metadata under /.well-known/openid-configuration.

How does front-channel SLO work in OIDC? From the spec:

OPs supporting HTTP-based logout need to keep track of the set of logged-in RPs so that they know what RPs to contact at their logout URIs to cause them to log out. Some OPs track this state using a "visited sites" cookie. OPs contact them in parallel using a dynamically constructed page with HTML <iframe src="frontchannel_logout_uri"> tags rendering each logged-in RP's logout URI

No mention of post_logout_redirect_uri. (OIDC session management spec used to talk about post_logout_redirect_uri but it was removed in the latest draft).

As the help doc you reference states, the front-channel logout URI the spec talks about is retrieved by Salesforce from the connected app's Single Logout field.

For post-logout redirect from Salesforce, you can configure a logout URL at the org level via Setup => Session Settings => Logout Page Settings => Logout URL. This will apply to all connected apps. The value of this config setting could point to a service based on your own custom code running wherever that can further examine the request and perform appropriate post-processing steps.

NB: OIDC session mgmt + SLO (both front and back channel) specifications are still drafts and not final.

  • 1
    Thanks for the swift answer. I saw the option for Setup => Session Settings => Logout Page Settings => Logout URL. We have other connected apps on this org, so we cant just set it to the Keycloak logout endpoint. I was hoping there would be a simple answer, but thanks for the advice on creating a custom service to manage post-logout logic. Aug 21 '20 at 11:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.