We are using Single-Sign-On from Salesforce.
So Salesforce SSO acts as the IdP (Identity Provider) while an external service acts as the SP (Service Provider).
When a user successfully logs in in SP via the SSO, his browser stores:
- A IdP session
- A SP session
When this user tries to log out, SP side can successfully revoke the SP session.
Question is: how to revoke the IdP session on the same go?
Does Salesforce SSO supply an endpoint for SP to call to fulfil this? I assume that SP doesn't know the IdP session value at all.