Support for single sign-out

[sattaman]

Currently signout is not ending the session with ID Server

http://docs.identityserver.io/en/release/endpoints/endsession.html#refendsession

https://openid.net/specs/openid-connect-session-1_0.html#RPLogout

Is this something I am going to need to achieve outside of this library?

[baltuonis]

config.serviceConfiguration.authorizationEndpoint = config.serviceConfiguration.revocationEndpoint
      const result = await this.appAuth.authorize(config);

• and you need to add a fast patch for callback (return from browser)

soon you will see it on my fork of this library

[asherzog]

Has anyone been able to make this work with Okta? I'm not sure how to access the Okta session Cookie in order to clear it when using the above workaround.

[sattaman]

@kadikraman Support has now been merged into master of appauth ios https://github.com/openid/AppAuth-iOS/pull/259/files

[spsaucier]

@asherzog Did you manage to clear the session when revoking Okta auth -- in particular, on Android?

I'm still getting the password field only, and if the user refreshes & clicks the 'Log Out' link there, then logs in again, it doesn't follow the callback to return the new user creds.

I tried clearing cookies with https://github.com/joeferraro/react-native-cookies, but that seems to have no effect.

[asherzog]

@spsaucier Nope, not with app-auth...

We ended up making our own bastardized flow that involves using Okta's inline hooks (https://developer.okta.com/docs/concepts/inline-hooks/) to help track the session ID and then built our own separate api around their session endpoints (https://developer.okta.com/docs/reference/api/sessions/#close-session) to revoke the user's session.

Pretty messy and I don't really recommend it, but it works for us I guess....

[spsaucier]

@asherzog so not using react-native-app-auth at all, then? That's a bummer. Thanks for the tip.