Skip to content

Index

Single Logout (SLO) is a security feature that logs users out of all active applications when they log out of authentik. It uses the OAuth2/OpenID Connect front-channel and back-channel logout specifications in combination with SAML's Single Logout specification.

For example, if a user is concurrently logged into an OIDC application and two SAML applications, when the user logs out of authentik, they will automatically be logged out of all three applications. Without SLO configured, users with active sessions across multiple applications would need to manually log out of each one.

:::info Check with your service provider to see if they support SAML Single Logout or OIDC front-channel/back-channel logout. Not all service providers support these features. :::

When Single Logout is triggered

Single Logout behavior depends on where the user initiates logout:

  • Logout from authentik: When a user logs out directly from authentik, the default-invalidation-flow runs. This flow includes a User Logout stage that ends the user's authentik session and triggers Single Logout for all connected applications.

  • Logout from an application: When a user logs out from an OIDC or SAML application, the invalidation flow that is selected on the provider runs. By default, this is the default-provider-invalidation-flow, which does not include a User Logout stage, so only that application's session is ended while the user's authentik session and other application sessions remain active.

For instructions on how to enable full Single Logout when a user logs out from an application, see Choose the logout behavior for a provider below.

How Single Logout works in authentik

When a user logs out or their session is terminated in authentik, the following process occurs:

  1. Session Termination: The user's session ends through one of the following:
    • User-initiated logout via a logout flow
    • Administrative action (session deletion or user deactivation)
    • Token revocation or expiration
  2. Provider Identification: authentik identifies all OAuth2/OIDC and SAML providers with active sessions for the users who have SLO configured.
  3. Logout Request Dispatch:
    • Back-channel: HTTP POST requests are sent directly from the authentik server to each back-channel provider's configured logout endpoint.
    • Front-channel: For user-initiated logouts, a logout stage is automatically injected into the flow that handles browser-based logout (typically via iframes or sequential redirects).
  4. Provider Processing: Each provider processes the logout request, validates it, and terminates the user's active session.
  5. Completion: After all providers have been notified, the user is redirected back to the authentik login screen.

Front-channel vs. back-channel logout

authentik supports both front-channel (browser-based) and back-channel (server-to-server) logout methods, depending on how each provider is configured.

Front-channel logout

Front-channel logout sends logout requests through the user's browser. authentik supports two front-channel modes:

iframe mode (default for OIDC)

  • Loads all provider logout URLs simultaneously in hidden iframes
  • Provides fast, parallel logout across multiple providers
  • Required by the OIDC front-channel logout specification
  • Most SAML providers also support iframe-based logout

Native Mode (SAML Only)

  • Uses the active browser tab to chain redirects and POST requests sequentially
  • Provides better compatibility with SAML providers that have iframe restrictions
  • Each provider redirects the user back to authentik before proceeding to the next provider
  • Not available for OIDC providers as the specification requires iframe support

:::info Use native front-channel mode for SAML providers if you encounter iframe compatibility issues, such as Content Security Policy (CSP) restrictions or cookie handling problems. :::

Back-channel Logout

Back-channel logout sends logout requests directly from the authentik server to each provider's logout endpoint via HTTP POST.

  • Does not require user browser interaction
  • Works even when the user is offline or their browser is closed
  • Is automatically triggered by administrators terminating a user session (user deactivation or session deletion)
  • Requires the provider to accept server-to-server POST requests

For SAML: Requires POST SLS binding. For OIDC: Requires a logout_uri configured for back-channel that accepts logout tokens.

Choose the logout behavior for a provider

When a user logs out from an application, authentik runs the flow that is selected in the Invalidation Flow field of that application's provider. The flow that you select determines whether only the application session ends, or whether the user is also logged out of authentik and all other applications.

authentik includes two default invalidation flows that you can select for each provider:

Invalidation flow Behavior when the user logs out from the application
default-provider-invalidation-flow Only the session of that application ends. The user's authentik session and their sessions in other applications remain active. This flow is selected by default for new providers.
default-invalidation-flow Full Single Logout. The flow includes a User Logout stage, which ends the user's authentik session and logs them out of all applications.

To choose the logout behavior for a provider, follow these steps:

  1. Log in to authentik as an administrator and open the authentik Admin interface.
  2. Navigate to Applications > Providers.
  3. Click the Edit icon of the provider that you want to configure.
  4. Under Advanced flow settings, select a flow in the Invalidation Flow field:
    • To only end the application session, select default-provider-invalidation-flow.
    • To enable full Single Logout, select default-invalidation-flow.
  5. Click Update.

Because the flow is selected per provider, you can enable full Single Logout only for sensitive applications and keep the default behavior for others.

Enable Single Logout

Enabling single logout requires configuring logout endpoints on your SAML or OIDC providers in authentik.

SAML Providers

See the SAML Single Logout documentation for detailed instructions. You will need to:

  1. Configure the SLS URL (Single Logout Service URL) - the provider's logout endpoint
  2. Select the SLS Binding (Redirect or POST)
  3. Choose a Logout Method; front-channel iframe, front-channel native, or back-channel
  4. Optionally, enable Sign Logout Request for additional security

OIDC providers

See the OIDC Front-channel and Back-channel logout documentation for detailed instructions. You will need to:

  1. Configure the Logout URI - the provider's logout endpoint
  2. Enable the desired Logout Method; front-channel or back-channel
  3. Optionally configure logout token signing for back-channel requests

Single Logout for proxy providers and outposts

Proxy providers support Single Logout without any additional configuration. A proxy provider has no Logout URI or Logout Method setting, because the application's session is managed by the outpost and authentik notifies the outpost directly.

LDAP and RAC outposts also receive a notification when an authentik session ends. RADIUS outposts do not act on it.

Logout from authentik

When a user's authentik session ends, authentik notifies all connected outposts. Each proxy outpost then deletes the proxy sessions that were created from that authentik session. The next time that the user accesses the application, the outpost redirects them to authentik to log in again.

Outposts are notified when the authentik session ends for any of the following reasons:

  • The user logs out via a logout flow.
  • An administrator deletes the session or deactivates the user.
  • The session expires.

Only proxy sessions that were created from the ended authentik session are deleted. Proxy sessions that the same user created from another browser or device remain active.

:::info Outposts are notified asynchronously, and only outposts that are connected to authentik receive the notification. If an outpost is not connected to the authentik server when the authentik session ends, its proxy sessions remain valid until they expire. The lifetime of a proxy session is defined by the Token validity setting of the proxy provider. :::

Logout from a proxied application

To log out of an application that is protected by a proxy provider, the user navigates to <authentik FQDN>/outpost.goauthentik.io/sign_out. For the host to use in each proxy mode, see Log out.

The outpost deletes all proxy sessions for that user within the outpost, and then redirects the user to authentik, where the invalidation flow of the provider runs. By default, the user's authentik session and their sessions in other applications remain active. To also end those sessions, see Choose the logout behavior for a provider.

LDAP providers

LDAP outposts receive the same notification when an authentik session ends. Each LDAP bind that runs the bind flow creates its own authentik session for the user, which is listed on the user's Sessions tab. When that session ends, the outpost closes the LDAP connection that the bind created, and the client must reconnect and bind again.

The session of an LDAP bind ends for the following reasons:

  • An administrator deletes the session or deactivates the user.
  • The session expires.

Logging out of authentik in a browser does not affect LDAP connections, because the browser session is separate from the session that the bind created.

:::info Connections are only closed in the Direct bind mode. In the Cached bind mode, binds that are served from the cache of the outpost do not create an authentik session and are not reliably closed when a session ends. :::

RAC providers

Connections to a RAC provider also end when the user's authentik session ends. For more information, see Connection and session expiry.

Session tracking

authentik tracks provider sessions to enable single logout:

  • SAML: Creates SAMLSession records containing the SessionIndex, NameID, and NameID format for each successful authentication.
  • OIDC: Tracks session identifiers (sid) and ID tokens required for logout requests.

These session records are automatically created during authentication and deleted after logout or expiration.

Administrative session termination

Back-channel logout is always triggered when a user session is terminated via administrative actions:

  • Session Deletion: When an administrator manually deletes a user's session through the Admin interface or API, authentik sends back-channel logout requests to all configured providers.
  • User Deactivation: When a user account is deactivated, authentik automatically sends back-channel logout requests to terminate all active sessions across all providers.

These requests are processed asynchronously to avoid blocking administrative operations.

Resources