What is the purpose of Single Logout (SLO) in an SSO environment?

Question

Options

• ATo terminate the user's session on the SP and IdP simultaneously.
• BTo ensure that user credentials are removed from the IdP after logout.
• CTo automatically log out users after a period of inactivity.
• DTo provide a seamless user experience during the SSO process.

• A
  88% (21)
• B
  4% (1)
• D
  8% (2)

Explanation

Single Logout (SLO) solves a specific coordination problem in SSO: when a user logs out of one Service Provider (SP), SLO propagates that logout signal to the Identity Provider (IdP) and all other SPs that were part of the same SSO session, terminating all sessions simultaneously - which is exactly what A describes.

Why the distractors fail:

• B is wrong because SLO doesn't remove credentials from the IdP; it invalidates the session token, not the stored user account or password.
• C describes session timeout/idle timeout, a separate mechanism unrelated to SLO's logout propagation.
• D describes the general goal of SSO itself (seamless login), not SLO specifically.

Memory tip: Think of SLO as a "logout broadcast" - one logout signal fans out to all parties (SP + IdP) at once, just like a single announcement reaching an entire room. If SSO is "one login for all," SLO is "one logout for all."

No community discussion yet for this question.