Logout Everywhere With Mixed SAML and OIDC Applications
PingFederate 11.2 is the IdP for three applications. App A is a SAML SP that supports SAML single logout with POST binding. App B is a SAML SP that has no SLO endpoint and keeps its own session for 12 hours. App C is an OIDC client that supports front-channel logout. PingFederate idle session timeout is 20 minutes and maximum session is 8 hours; OAuth refresh tokens last 12 hours. Users report that after they click Logout in the PingFederate portal, they can still open App B in the same browser, and sometimes App C opens without a new login. The security team wants logout everywhere and has asked you to enable it for all three apps. You cannot change App B's vendor software this quarter.
1. Explain why Apps B and C can remain accessible after PingFederate logout. Classify what PingFederate can and cannot control for each app.
Read the worked answer
PingFederate logout ends the PingFederate session and sends single logout only to SPs that support it and have SLO configured. App A can be logged out because it supports SAML SLO with POST binding; PingFederate can send a LogoutRequest to its SLO endpoint.
App B has no SLO endpoint. PingFederate has no protocol way to terminate App B's own 12-hour session. The user can keep using App B until that session expires, regardless of PingFederate logout.
App C may remain because front-channel logout is not configured, the registered logout URI is not reachable from the browser, or App C keeps its own session. OIDC logout also does not automatically revoke refresh tokens. So PingFederate can control its own session and, with configuration, A and C; it cannot force B to log out remotely. Do not promise logout everywhere for B without a vendor change or a shorter app session.
2. Design a logout approach for each app and state the residual risk you would report to security.
Read the worked answer
For App A, configure SAML SLO with POST binding in the SP connection and test both IdP-initiated and SP-initiated logout. For App C, configure OIDC front-channel logout with the correct registered logout URI and verify the browser can reach it; use back-channel logout if the client supports it. For App B, document that remote logout is not possible. If App B has a configurable session timeout, shorten it; otherwise accept the 12-hour residual risk or require the vendor upgrade.
For refresh tokens, decide explicitly whether logout must revoke them. If so, call the revocation endpoint or remove the persistent grant as part of logout; otherwise a logged-out browser can mint new tokens. Keep the PingFederate idle timeout at 20 minutes and maximum at 8 hours unless risk requires shorter.
Residual risk to report: App B sessions survive IdP logout for up to 12 hours; App C depends on browser reachability and correct client configuration; token revocation is separate from session logout. Test in one browser and in separate browsers.