Logout user from Onelogin account in our app

Question

I got a problem and better if you could reply as soon as possible. we are using OIDC auth code flow to authenticate our application with oneLogin. We want to implement a logout function, but the issue is when revoke token and redirect to our application home page if the user is lpogged in to oneLogin, it sends user back to the oneLogin and authenticate again which makes impossible to log out from our application.

So my question is, do we have any way to log out user from oneLogin, therefore when the redirection happens user's credentials are requested again?

Or is there any suggested way to implement OIDC auth code flow which circumvate this logout issue?

Answer 1

Revoking the OIDC token only invalidate the token for your application. It does not kill the session the user has with Onelogin. You can remove the Onelogin session using the Log User Out API. https://developers.onelogin.com/api-docs/1/users/log-user-out