Configuring single logout (SLO) with SAML

Edit online

Configure SLO so that when you log out of an IBM Cloud Pak that includes a SAML integration, you are automatically logged out of all related sessions that were established during single sign-on (SSO).

Note: SLO is not compatible with Microsoft Azure.

Depending on your version of IBM Cloud Pak® foundational services, you can configure SLO with APIs or the console:

In Support Cycle-2 (SC-2) versions 4.6.15 and later or Continuous Delivery (CD) versions 4.14 and later, use the IdP V3 API to configure SLO. For more information, see SAML clients.
- Configure SLO by adding the sp_logout field and setting it to true in the IdP V3 API.
- The default value is false.
```
 {
 "idp_config": {
 "sp_logout": false // The default value of this optional field is false. Set it to true to enable the SLO feature.
 // other attributes
 }
 }
 
```
In CD versions 4.14.0 and later, from New SAML connection, in Connection details, select Logout all single sign-on sessions on logout.

Configuring the Liberty authentication cache timeout

Edit online

version 4170 In CD versions 4.17.0 and later, the duration of the Liberty authentication cache can be configured. If you see a blank screen after you log out, and the IdP session continues to exist, you can increase the spec.config.libertyAuthCacheTimeout value, which has a default value of 10 minutes.

Update the authentications.operator.ibm.com custom resource by using the following command. Replace <custom-resource-name> with your custom resource name and <namespace> with your namespace name.
```
oc edit authentications.operator.ibm.com <custom-resource-name> -n <namespace>
```
Add or modify the spec.config.libertyAuthCacheTimeout value to a suitable duration, for example, 10h for 10 hours or 300m for 300 minutes or 5 hours. For more information about deciding a suitable duration, see the note in Configuring the authentication cache in Liberty.
If the spec.config.libertyAuthCacheTimeout value is absent in the custom resource, it implies that the Liberty authentication cache timeout value is set to the default value of 10 minutes.
Wait for the platform-auth-service pods to restart for the change to be applied.
To revert the change and restore the default Liberty authentication cache timeout value, update the authentications.operator.ibm.com custom resource and remove the spec.config.libertyAuthCacheTimeout field.