# Need Help Configuring Logout
**URL:** https://discourse.openondemand.org/t/need-help-configuring-logout/4943
**Category:** Get Help
**Created:** [August 10, 2026, 2:14pm UTC](https://discourse.openondemand.org/t/need-help-configuring-logout/4943 "2026-08-10T14:14:27Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@rishabhs002](https://discourse.openondemand.org/u/rishabhs002)
#### Post date: [August 10, 2026, 2:14pm UTC](https://discourse.openondemand.org/t/need-help-configuring-logout/4943/1 "2026-08-10T14:14:27Z")
[https://domain.com/pun/sys/dashboard/logout](https://domain.com/pun/sys/dashboard/logout)
I am getting this message when clicking on logout button. Need help configuring logout functionality. I am using OKTA based login. This message appears on the OOD dashboard.
---
### Author:  [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)
#### Post date: [August 10, 2026, 2:36pm UTC](https://discourse.openondemand.org/t/need-help-configuring-logout/4943/2 "2026-08-10T14:36:57Z")
That seems like an OKTA thing which I’m not too familiar with. I would explore OKTA settings and documentation.
---
### Author:  [@rishabhs002](https://discourse.openondemand.org/u/rishabhs002)
#### Post date: [August 10, 2026, 3:04pm UTC](https://discourse.openondemand.org/t/need-help-configuring-logout/4943/3 "2026-08-10T15:04:32Z")
Hi @jeff.ohrstrom
In my okta configuration inside ood\_portal.yml, I have set logout\_redirect to “[https://domain.com/pun/sys/dashboard/logout](https://domain.com/pun/sys/dashboard/logout)”
and on the okta side it is set to the same thing.
Is this the correct logout url for OOD?
---
### Author:  [@rishabhs002](https://discourse.openondemand.org/u/rishabhs002)
#### Post date: [August 10, 2026, 3:15pm UTC](https://discourse.openondemand.org/t/need-help-configuring-logout/4943/4 "2026-08-10T15:15:22Z")
Also I am running this in incognito mode. It is the same in normal mode.
---
### Author:  [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)
#### Post date: [August 10, 2026, 3:35pm UTC](https://discourse.openondemand.org/t/need-help-configuring-logout/4943/5 "2026-08-10T15:35:43Z")
It seems to be all configured from the apache side, but when I googled your issue, there are settings on the OKTA side that you can change like this one below.
> **[Okta Support Center (Lightning)](https://support.okta.com/help/s/article/Closing-the-browser-and-reopening-prompts-me-to-log-in-again?language=en_US)**
---
### Author:  [@rishabhs002](https://discourse.openondemand.org/u/rishabhs002)
#### Post date: [August 10, 2026, 4:24pm UTC](https://discourse.openondemand.org/t/need-help-configuring-logout/4943/6 "2026-08-10T16:24:08Z")
Just confirmed with the OKTA team, we won’t be able to alter this setting as this would affect other apps as well.
Using
logout\_redirect: “/oauth2/idpresponse?logout=https%3A%2F%[2Fdomain.com](http://2Fdomain.com)”
When a user clicks **Logout** , OOD appears to initiate the logout, but instead of leaving the user logged out, they are immediately authenticated again. There is no login page or login button shown in between — the logout essentially results in the user being signed back in automatically.
Using
logout\_redirect: “/oidc?logout=https%3A%2F%[2Fdomain.com](http://2Fdomain.com)”
**results in 404 error**
using
[https://domain.com/pun/sys/dashboard/logout](https://domain.com/pun/sys/dashboard/logout)
results in the first screenshot I sent.
---
### Author:  [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)
#### Post date: [August 10, 2026, 4:57pm UTC](https://discourse.openondemand.org/t/need-help-configuring-logout/4943/7 "2026-08-10T16:57:24Z")
> [@rishabhs002](#):
>
> Using
>
> logout\_redirect: “/oidc?logout=https%3A%2F%[2Fdomain.com](http://2Fdomain.com)”
>
> **results in 404 error**
Do you have `oidc_uri` set to `/oidc`?
---
### Author:  [@rishabhs002](https://discourse.openondemand.org/u/rishabhs002)
#### Post date: [August 11, 2026, 6:04am UTC](https://discourse.openondemand.org/t/need-help-configuring-logout/4943/8 "2026-08-11T06:04:16Z")
it was set to
oidc\_uri: “/oauth2/idpresponse”
I updated it to “/oidc”
and logout\_redirect as
logout\_redirect: “/oidc?logout=https%3A%2F%[2Fdomain.com](http://2fdomain.com/)”
The same thing is happening OOD appears to initiate the logout, but instead of leaving the user logged out, they are immediately authenticated again.
---
### Author:  [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)
#### Post date: [August 12, 2026, 1:53pm UTC](https://discourse.openondemand.org/t/need-help-configuring-logout/4943/9 "2026-08-12T13:53:26Z")
I’m not entirely sure what could be happening. What does your OKTA team say? Is this expected behavior from their side?
---
### Author:  [@rishabhs002](https://discourse.openondemand.org/u/rishabhs002)
#### Post date: [August 12, 2026, 2:02pm UTC](https://discourse.openondemand.org/t/need-help-configuring-logout/4943/10 "2026-08-12T14:02:32Z")
Where does it redirect to once we click the logout button? Could you please share a screenshot?
and what is the logout endpoint?
---
### Author:  [@rishabhs002](https://discourse.openondemand.org/u/rishabhs002)
#### Post date: [August 12, 2026, 2:48pm UTC](https://discourse.openondemand.org/t/need-help-configuring-logout/4943/11 "2026-08-12T14:48:01Z")
In our setup the outlook accounts are linked to the user present in the OOD server.
so eg- my outlook account is [Rishabh.Singhal@outlook.com](mailto:Rishabh.Singhal@outlook.com) which is linked to my user rsinghal (present in OOD server).
Since my outlook is always signed in, it tries to sign out but signs back in again.
This behaviour does not happen in incognito mode. In incognito mode I am redirected to login page.
using-
logout\_redirect: “/oauth2/idpresponse?logout=https%3A%2F%[2Fdomain.com](http://2fdomain.com/)”
---
### Author:  [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)
#### Post date: [August 12, 2026, 3:21pm UTC](https://discourse.openondemand.org/t/need-help-configuring-logout/4943/12 "2026-08-12T15:21:21Z")
Here’s what it looks like on my system with `oidc_uri: /oidc` and `logout_redirect: /oidc?logout=https%3A%2F%2Fdomain.com`
When you updated the configs, were you sure to bounce httpd. Also your `oidc_uri` and logout need uri need to match.
I.e., these 2 match:
```yaml
oidc_uri: "/oauth2/idpresponse"
logout_redirect: “/oauth2/idpresponse?logout=https%3A%2F%2Fdomain.com”
```
or
```auto
oidc_uri: "/oidc"
logout_redirect: “/oidc?logout=https%3A%2F%2Fdomain.com”
```
Turning on apache oidc logging may help indicate what’s going on as well.
---
### Author:  [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)
#### Post date: [August 12, 2026, 3:23pm UTC](https://discourse.openondemand.org/t/need-help-configuring-logout/4943/13 "2026-08-12T15:23:05Z")
Note the domains in my image there. `/oidc?logout` sends me to my IDP which sends me back to my ondemand server which then sends me back to my IDP where I’m prompted to login.
---
### Author:  [@rishabhs002](https://discourse.openondemand.org/u/rishabhs002)
#### Post date: [August 14, 2026, 2:01pm UTC](https://discourse.openondemand.org/t/need-help-configuring-logout/4943/14 "2026-08-14T14:01:31Z")
> [@jeff.ohrstrom](#):
>
> ```auto
> oidc_uri: "/oauth2/idpresponse"
> logout_redirect: “/oauth2/idpresponse?logout=https%3A%2F%2Fdomain.com”
>
> ```
>
> or
>
> ```auto
> oidc_uri: "/oidc"
> logout_redirect: “/oidc?logout=https%3A%2F%2Fdomain.com”
>
> ```
I have tried both these approaches with apache restart.
The OOD portal never asks me for login.
One important observation:
When I launch OOD in normal chrome window I am facing the auto login after sign out issue.
In Incognito mode:
Its working perfectly, I click on sign out I get redirected to the login page.
---
### Author:  [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)
#### Post date: [August 14, 2026, 2:42pm UTC](https://discourse.openondemand.org/t/need-help-configuring-logout/4943/15 "2026-08-14T14:42:03Z")
How about clearing your browser cache for your site in a normal window? Does it prompt you for sign-in then?
---
### Author:  [@rishabhs002](https://discourse.openondemand.org/u/rishabhs002)
#### Post date: [August 17, 2026, 9:14am UTC](https://discourse.openondemand.org/t/need-help-configuring-logout/4943/16 "2026-08-17T09:14:04Z")
1. I opened the OOD portal (normal chrome window)
2. Log in happened automatically
3. Deleted site data and cookies
4. Clicked on Logout
It does the logout procedure but then it immediately starts signing in. Its picking up the session cookies from somewhere.
I am running this inside a VDI and my VDI account is the same account that OOD and Outlook use.
I did a bit of research and one of the AI tools suggested me
"We have confirmed that OOD is correctly invoking the OIDC `end_session_endpoint`. The browser sends a request to `/oauth2/v1/logout` with both `id_token_hint` and `post_logout_redirect_uri`, and Okta returns HTTP 200. However, in a normal Chrome session, the user is immediately authenticated again when OOD redirects back to the authentication flow. The same OOD logout works correctly in Chrome Incognito.
The ID token shows `idp: DSSO`. Could you please verify whether the DSSO/Okta session is being terminated by the OIDC logout request, and whether the DSSO session can cause automatic re-authentication after logout?"
---
### Author:  [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)
#### Post date: [August 18, 2026, 1:58pm UTC](https://discourse.openondemand.org/t/need-help-configuring-logout/4943/17 "2026-08-18T13:58:04Z")
I’m not really sure what’s going on here. Maybe @tdockendorf knows more.
---
### Author:  [@tdockendorf](https://discourse.openondemand.org/u/tdockendorf)
#### Post date: [August 18, 2026, 2:59pm UTC](https://discourse.openondemand.org/t/need-help-configuring-logout/4943/18 "2026-08-18T14:59:21Z")
OnDemand relies on mod\_auth\_openidc for logout. If the Redirect URI:
```auto
OIDCRedirectURI /oidc
```
With mod\_auth\_openidc a logout is performed by going to the Redirect URI path but with `logout` query parameter so something like `/oidc?logout=https%3A%2F%2Fondemand.osc.edu` and that is how mod\_auth\_openidc handles logouts. If it’s not working with Okta then maybe an issue with mod\_auth\_openidc and what Okta expects. For OnDemand this is what our settings look like:
```auto
oidc_uri: "/oidc"
logout_uri: "/logout"
logout_redirect: "/oidc?logout=https%3A%2F%2Fondemand.osc.edu"
```
---
### Author:  [@rishabhs002](https://discourse.openondemand.org/u/rishabhs002)
#### Post date: [August 19, 2026, 7:10am UTC](https://discourse.openondemand.org/t/need-help-configuring-logout/4943/19 "2026-08-19T07:10:38Z")
We figured it out.
In a normal Chrome window, the key factor appears to be **Kerberos/DSSO** :
1. The user clicks **Logout** in OOD.
2. OOD clears its local session cookie.
3. OOD redirects the user to the Okta logout URL.
4. Okta may clear its web session cookie.
5. The browser is redirected back to [https://ood-domain.com](https://ood-domain.com).
6. OOD sees that there is no local session and immediately initiates OIDC login again.
7. Okta receives the authentication request and, because **DSSO is enabled** , performs silent Kerberos authentication (SPNEGO) using the user’s machine/AD login context.
8. A new Okta session is created automatically, and the user is immediately logged back into OOD.
So, the logout itself **does happen successfully at the OOD level**. The issue is that Kerberos/DSSO immediately authenticates the user again, making it appear as though the logout did not work.
In **Incognito mode** , logout works as expected because it uses an isolated cookie/session environment, without the existing Okta session or device-trust context.
We also tried logging out directly from the Okta dashboard, but the same issue occurs there as well — after logout, Okta automatically signs us back in through Kerberos/DSSO.
**Planned approach**
As a next step, we are planning to create a **static HTML logout/landing page within OOD** and redirect the user to that page after they click Logout.
---
### Author:  [@system](https://discourse.openondemand.org/u/system)
#### Post date: [August 21, 2026, 7:11am UTC](https://discourse.openondemand.org/t/need-help-configuring-logout/4943/20 "2026-08-21T07:11:19Z")
This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.