Skip to content

Requirements

  • Lime Portal >= 1.3.3
  • Lime CRM solution
  • On-premise:
  • Cloud:
    • Included in Solution Cloud Shared / Requires isolated application using lime-crm: >=2.154.0

Version compatibility

OpenID single sign-out

Logging out of the OpenID provider on portal logout (RP-initiated logout) requires:

Component Minimum version
limepkg-portal-auth >= 1.18.3
Lime Portal >= 2.22.0

Upgrade order

The components can be upgraded in any order. This package hands the portal a logout nonce in the login callback, and the portal only redirects to /logout/openid/ when it holds one — older versions of this package issue no nonce, so the portal falls back to local-only logout (the behavior before single sign-out). Single sign-out activates automatically once both components are on the required versions.

Note that it takes effect per user at their first login after the upgrade: the id_token and logout nonce needed for provider logout are stored during login, so sessions started before the upgrade fall back to local-only logout one last time.

Provider configuration

Once this package is upgraded, the portal starts redirecting logouts to the OpenID provider for users who logged in after the upgrade. Make sure the portal's logged-out page is registered as an allowed post-logout redirect URI at the provider (see Configuration) — otherwise users may see a provider error page after logout. If registration is not possible, set OPENID_RP_INITIATED_LOGOUT=false on the portal to disable single sign-out.

Back to top