How to implement Single Sign Out for 2 applications in Azure AD B2C using predefined user flows

Question

we are using 2 Single page applications. we have registed 2 apps(one is for API & another one is for Web).
Now we want to implement single sign out (SLO) for my web apps. we tried to hit end-session endpoint(https://tenant.b2clogin.com/tenant.onmicrosoft.com/<policy-name>/oauth2/v2.0/logout. it is logging out the user from respective application but not other application.

we want to implement single logout for my both the applications.

Answer 1

@Khagesh

Thank you for posting your query on Microsoft Q&A, from above description I could understand that you are looking to achieve SLO via user flow for Azure B2C.

Please do correct me if this is not the case by responding in the comments section:

As per current design Single sign-out for B2C could be achieved only via Custom Policy the existing user flow would only signout from the app.

To support single sign-out, the token issuer technical profiles for both JWT and SAML must specify:

The protocol name, such as <Protocol Name="OpenIdConnect" />

The reference to the session technical profile, such as UseTechnicalProfileForSessionManagement ReferenceId="SM-jwt-issuer" />.

The following example illustrates the JWT and SAML token issuers with single sign-out:

<ClaimsProvider>
  <DisplayName>Local Account SignIn</DisplayName>
  <TechnicalProfiles>
    <!-- JWT Token Issuer -->
    <TechnicalProfile Id="JwtIssuer">
      <DisplayName>JWT token Issuer</DisplayName>
      <Protocol Name="OpenIdConnect" />
      <OutputTokenFormat>JWT</OutputTokenFormat>
      ...    
      <UseTechnicalProfileForSessionManagement ReferenceId="SM-jwt-issuer" />
    </TechnicalProfile>

    <!-- Session management technical profile for OIDC based tokens -->
    <TechnicalProfile Id="SM-jwt-issuer">
      <DisplayName>Session Management Provider</DisplayName>
      <Protocol Name="Proprietary" Handler="Web.TPEngine.SSO.OAuthSSOSessionProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
    </TechnicalProfile>

    <!--SAML token issuer-->
    <TechnicalProfile Id="Saml2AssertionIssuer">
      <DisplayName>SAML token issuer</DisplayName>
      <Protocol Name="SAML2" />
      <OutputTokenFormat>SAML2</OutputTokenFormat>
      ...
      <UseTechnicalProfileForSessionManagement ReferenceId="SM-Saml-issuer" />
    </TechnicalProfile>

    <!-- Session management technical profile for SAML based tokens -->
    <TechnicalProfile Id="SM-Saml-issuer">
      <DisplayName>Session Management Provider</DisplayName>
      <Protocol Name="Proprietary" Handler="Web.TPEngine.SSO.SamlSSOSessionProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
    </TechnicalProfile>
  </TechnicalProfiles>
</ClaimsProvider>

I would recommend you share this as feedback on our feedback portal.

---

Please "Accept the answer (Yes)" and "share your feedback ". This will help us and others in the community as well.

Thanks,

Akshay Kaushik