# Universal Logout

Use Okta Universal Logout to end active Mabyduck sessions from Okta.

> This page only applies to organizations with Okta SSO enabled.


## Who can use this feature?

- Mabyduck organization owners and admins.
- Okta admins.


Universal Logout is configured in Okta. It is triggered from the Okta Admin
Console.

## How it works

Okta Universal Logout sends a signed server-to-server revocation request to
Mabyduck. Mabyduck validates the request and ends the matching user's active
Mabyduck sessions.

Removing a user's Okta app assignment blocks future sign-in. Universal Logout is
what lets Okta also end an active Mabyduck session.

Mabyduck does not support OIDC Single Logout or a Post Logout URI. If Okta shows
a Post Logout URI field for the integration, leave it empty.

## Requirements

You need:

- a Mabyduck organization with Okta SSO enabled.
- a Mabyduck organization owner or admin account.
- an Okta tenant.
- an Okta admin account.
- the Mabyduck organization login slug.
- the Mabyduck Okta app integration assigned to the users who should sign in.
- the Okta app instance ID for the Mabyduck app integration.


To find the Okta app instance ID:

1. Log in to your organization's Okta Admin Console.
2. Go to `Applications` -> `Applications`.
3. Select the Mabyduck app integration.
4. Copy the `<APPLICATION_ID>` value from the app URL:
`https://{your-company}-admin.okta.com/admin/app/<APPLICATION_NAME>/instance/<APPLICATION_ID>/`


## Confirm Universal Logout support in Mabyduck

Confirm that Mabyduck has enabled Okta SSO for your organization.

Use this global token revocation endpoint:

`https://app.mabyduck.com/oauth2/okta/{org-slug}/revoke/`

Replace `{org-slug}` with your Mabyduck organization login slug. For example, if
your organization login URL is:

`https://app.mabyduck.com/org/acme/`

Then the revocation endpoint is:

`https://app.mabyduck.com/oauth2/okta/acme/revoke/`

Use a custom domain only if Mabyduck has confirmed one for your organization.
The endpoint must match exactly, including the trailing slash.

## Enable Universal Logout in Okta

To extend Okta Universal Logout to Mabyduck:

1. Log in to your organization's Okta Admin Console.
2. Go to `Applications` -> `Applications`.
3. Select the Mabyduck app integration.
4. Open the `Authentication` tab.
5. In the `Logout` section, click `Edit`.
6. Select `Okta system or admin initiates logout`.
7. Use the Mabyduck global token revocation endpoint.
8. Set the authentication method to `SIGNED_JWT`.
9. Set the subject format to `Issuer and Subject identifier`.
10. Click `Save`.


## Send configuration details to Mabyduck

Send these details to [support@mabyduck.com](mailto:support@mabyduck.com) and
request Universal Logout enablement:

- Okta issuer URL.
- Mabyduck organization login slug.
- Okta app instance ID for the Mabyduck app integration.


Mabyduck will confirm when Universal Logout is enabled for your organization.

## Token lifetime

Okta OIN OIDC integrations use the Okta organization authorization server. Okta
access tokens and ID tokens expire after one hour.

Refresh tokens are not supported for SSO OIDC integrations published in the OIN.

Mabyduck uses the Okta access token only during sign-in. It does not store or
refresh the access token after the login exchange. Active Mabyduck sessions end
when the user logs out, the Mabyduck session expires, or Okta sends a valid
Universal Logout request.

Mabyduck application sessions expire after two weeks by default.

## Test access removal

To test Universal Logout:

1. Log in to the Okta Admin Console.
2. Open the user whose sessions you want to revoke.
3. Select the action to clear the user's sessions and revoke access.
4. Include logout-enabled apps when prompted.
5. Confirm the action.
6. Verify the user's active Mabyduck session ends.


You must include logout-enabled apps for Okta to send the Universal Logout
request to Mabyduck.

## Related pages

- [Configure Okta SSO](/account-and-settings/iam/okta)
- [Organization settings](/account-and-settings/organization)