Kill SSO session when user logged out

2
Hello Experts,   I have Implemented google SSO it’s working as expected no surprises. But when I try to log out it has to kill the IDP session as well as Mendix session, now it’s killing MX Session because I am using default sign out option in Mendix. Kindly let me know what has to be done for killing the IDP session. NOTE : In other Azure IDP I am able to be kill the session by re-directing to the specific URL but wondering how the same can be done for google SSO. Answers are really much appreciated! I have used this URL to redirect : https://accounts.google.com/Logout?&continue=yourredirecturl and redirected in browser when the user logs out but I am getting an error. I have added the screen shot kindly help me in this.
asked
3 answers
1

On stackoverflow I found this:
https://www.google.com/accounts/Logout?continue=https://appengine.google.com/_ah/logout?continue=http://www.example.com

 

(Original: https://stackoverflow.com/questions/4202161/google-account-logout-and-redirect)

answered
2

You can logout with the following URL in Google SSO: 
 

https://accounts.google.com/Logout?&continue=yourredirecturlhere
answered
0

I had this issue as well, to fix it I created a Java script on the JS_Logout code that just runs the clearing of SSO cookies for google in the background and gave it a wait time of 1 second. This  shows a loading screen on my page for a second and takes me to my login page as soon as this action was completed. 

Below is the code I used (ignore the Microsoft i was playing about with different SSO's):

// This file was generated by Mendix Studio Pro.

//

// WARNING: Only the following code will be retained when actions are regenerated:

// - the import list

// - the code between BEGIN USER CODE and END USER CODE

// - the code between BEGIN EXTRA CODE and END EXTRA CODE

// Other code you write will be lost the next time you deploy the project.

import "mx-global";

import { Big } from "big.js";

 

// BEGIN EXTRA CODE

// END EXTRA CODE

 

/**

* @param {string} logoutURL

* @returns {Promise.<void>}

*/

export async function JS_Logout(logoutURL) {

// BEGIN USER CODE

 

// Where you want to land after logout

const RETURN_ROUTE = "/?profile=Responsive"; // change if you prefer "/"

const RETURN_URL = `${window.location.origin}${RETURN_ROUTE}`;

const WAIT_MS = 1000; // background wait time

 

const toLower = s => (s || "").toLowerCase();

const isGoogle = v => {

try {

const s = toLower(v);

if (s === "google") return true;

const h = new URL(v, window.location.href).hostname.toLowerCase();

return h.includes("accounts.google.com") || h.endsWith("google.com");

} catch { return false; }

};

const isMicrosoft = v => {

try {

const s = toLower(v);

if (s === "microsoft") return true;

const h = new URL(v, window.location.href).hostname.toLowerCase();

return h.includes("microsoftonline.com") || h.includes("b2clogin.com");

} catch { return false; }

};

 

const microsoftLogoutUrl = () => {

const u = new URL("https://login.microsoftonline.com/organizations/oauth2/v2.0/logout");

u.searchParams.set("post_logout_redirect_uri", RETURN_URL);

return u.toString();

};

 

// Small spinner so the page isn't blank while we wait

const showSpinner = () => {

const el = document.createElement("div");

el.id = "mx-logout-spinner";

el.style.cssText =

"position:fixed;inset:0;background:rgba(255,255,255,.85);display:flex;align-items:center;justify-content:center;z-index:999999";

el.innerHTML =

'<div style="border:6px solid #eee;border-top:6px solid #f60;border-radius:50%;width:48px;height:48px;animation:mxspin 1s linear infinite"></div>' +

"<style>@keyframes mxspin{to{transform:rotate(360deg)}}</style>";

document.body.appendChild(el);

};

const hideSpinner = () => {

const x = document.getElementById("mx-logout-spinner");

if (x) x.remove();

};

 

// 1) End Mendix session first

try { await mx.session.logout(); } catch {}

 

// 2) Provider-specific handling

if (isGoogle(logoutURL)) {

// ---- GOOGLE: background logout to avoid the google.com Redirect Notice ----

showSpinner();

try {

// Just hitting Accounts logout is enough to clear Google SSO cookies.

const iframe = document.createElement("iframe");

iframe.title = "google-logout";

iframe.style.cssText = "position:absolute;width:0;height:0;border:0;visibility:hidden";

document.body.appendChild(iframe);

iframe.src = "https://accounts.google.com/Logout";

 

setTimeout(() => {

try { iframe.remove(); } catch {}

hideSpinner();

window.location.assign(RETURN_URL);

}, WAIT_MS);

} catch {

hideSpinner();

window.location.assign(RETURN_URL);

}

return;

}

 

if (isMicrosoft(logoutURL)) {

// ---- MICROSOFT: same-tab logout; AAD often blocks iframes for sign-out ----

window.location.assign(microsoftLogoutUrl());

return;

}

 

// Fallback: if we can't detect, just go to your login

window.location.assign(RETURN_URL);

 

// END USER CODE

}

answered