Skip to main content

Universal Logout

Use Okta Universal Logout to end active Mabyduck sessions from Okta.

This page only applies to organizations with Okta SSO enabled.

Who can use this feature?​

  • Mabyduck organization owners and admins.
  • Okta admins.

Universal Logout is configured in Okta. It is triggered from the Okta Admin Console.

How it works​

Okta Universal Logout sends a signed server-to-server revocation request to Mabyduck. Mabyduck validates the request and ends the matching user's active Mabyduck sessions.

Removing a user's Okta app assignment blocks future sign-in. Universal Logout is what lets Okta also end an active Mabyduck session.

Mabyduck does not support OIDC Single Logout or a Post Logout URI. If Okta shows a Post Logout URI field for the integration, leave it empty.

Requirements​

You need:

  • a Mabyduck organization with Okta SSO enabled.
  • a Mabyduck organization owner or admin account.
  • an Okta tenant.
  • an Okta admin account.
  • the Mabyduck organization login slug.
  • the Mabyduck Okta app integration assigned to the users who should sign in.

Confirm Universal Logout support in Mabyduck​

Confirm that Mabyduck has enabled Okta SSO for your organization.

Use this global token revocation endpoint:

https://app.mabyduck.com/oauth2/okta/{org-slug}/revoke/

Replace {org-slug} with your Mabyduck organization login slug. For example, if your organization login URL is:

https://app.mabyduck.com/org/acme/

Then the revocation endpoint is:

https://app.mabyduck.com/oauth2/okta/acme/revoke/

Use a custom domain only if Mabyduck has confirmed one for your organization. The endpoint must match exactly, including the trailing slash.

Enable Universal Logout in Okta​

To extend Okta Universal Logout to Mabyduck:

  1. Log in to your organization's Okta Admin Console.
  2. Select Applications from the Applications menu.
  3. Select the Mabyduck app integration.
  4. Open the app authentication settings.
  5. Enable Universal Logout for the app.
  6. Use the Mabyduck global token revocation endpoint.
  7. Set the authentication method to SIGNED_JWT.
  8. Set the subject format to Issuer and Subject identifier.
  9. Save the changes.

Token lifetime​

Okta OIN OIDC integrations use the Okta organization authorization server. Okta access tokens and ID tokens expire after one hour.

Refresh tokens are not supported for SSO OIDC integrations published in the OIN.

Mabyduck uses the Okta access token only during sign-in. It does not store or refresh the access token after the login exchange. Active Mabyduck sessions end when the user logs out, the Mabyduck session expires, or Okta sends a valid Universal Logout request.

Mabyduck application sessions expire after two weeks by default.

Test access removal​

To test Universal Logout:

  1. Log in to the Okta Admin Console.
  2. Open the user whose sessions you want to revoke.
  3. Select the action to clear the user's sessions and revoke access.
  4. Include logout-enabled apps when prompted.
  5. Confirm the action.
  6. Verify the user's active Mabyduck session ends.

You must include logout-enabled apps for Okta to send the Universal Logout request to Mabyduck.