The Kinvey logout call as provided with Kinvey SDK's will log out the Kinvey session only. This is typically the desired behavior since the idP's login might be shared by several applications on the mobile device. For instance, if MIC is implemented against Salesforce, there might be other mobile apps wanting to leverage the existing SFDC cookies. But in some cases, this is not desired.
In order to log out both Kinvey and the 3rd-party identity provider, the application must call both logout functions. This could be implemented by triggering two actions on the "logout" button click:
1. Call the Kinvey SDK logout call: Kinvey.ActiveUser.logout() (specific syntax differs per SDK)
2. Open a URL to go to the idP's particular "sso logout" url. This will typically open up a webview. Some idP's also offer a redirect back to the app, in which case you case use the same redirect URI that you use for login (e.g. "myApp://").
Here are the logout urls for some common idP's that Kinvey customers often integrate with:
- (note: this might globally log out all sessions for that user)
OKTA: (guide) call "/oauth2/v1/logout?id_token_hint=myidtoken&post_logout_redirect_uri=myApp://"
- (note: for "myidtoken", you can use the MIC config to pass Allowed Attribute "id_token" to your User Record on the client)
Salesforce: () call "$instance_url/secur/logout.jsp"
- (note: for "instance_url", you can use the MIC config to pass Allowed Attribute "instance_url" to your User Record on the client)