Single sign-on (SSO)

With the GUI

You can configure the SSO through the GUI.

1. Navigate to the Cloud Directory > Single Sign-on tab of the App ID dashboard.

2. Toggle Enable single sign-on to Enabled.

3. Set the amount of time that a user can be inactive before the SSO session expires. When it expires, they must sign in again. The time is specified in minutes and the maximum allowed time for inactivity is 10,080 minutes (7 days). The default time is 1440 minutes, which is the equivalent of 1 day.

4. Add your redirect URIs to the Logout redirect URI box and click the + sign. Be sure to register only applications that you trust. By registering the URI, you're authorizing App ID to include it in the authorization workflow.

5. Click Save.

With the API

By using the SSO Configuration Admin API to define three settings, you can turn on the feature.

An example call:

{
  "isActive": true,
  "inactivityTimeoutSeconds": 86400,
  "logoutRedirectUris": [
    "http://my-first-app.com/after_logout",
    "http://my-second-app.com/after_logout"
  ]
}

By using the API

To sign out a user, redirect their browser by using your information to complete the following API call.

https://<region>.appid.cloud.ibm.com/oauth/v4/<tenantID>/cloud_directory/sso/logout?redirect_uri=<redirectURI>&client_id=<clientID>

Even if the SSO session is ended, a user with a valid access token that is stored in their session might not be required to enter their credentials again until their token expires. By default the token expires after 1 hour.

By using the Node.JS server SDK

You can also use the App ID Node.js server SDK to automatically handle the redirection for you.

1. Set logoutSSO as a method. For example:

   let webAppStrategy = new WebAppStrategy(.....);
   ....
   webAppStrategy.logoutSSO();
   

2. Configure logout.

   app.get('/logoutSSO', (req, res) => {
      res.clearCookie("refreshToken");
      webAppStrategy.logoutSSO(req,res, { "redirect_uri": "https://my-app.com/after_logout" });
      });