Review SSO Session Boundaries
Trace identity-provider login and logout through application sessions so sign-out, role changes, and reauthentication behave as stated.
Signing out of an identity provider does not necessarily end an application session. The app may keep its own cookie, cache claims, or refresh through another channel. Review both sides of the boundary before promising a user that logout or role removal ends access.
Map the SSO protocol, IdP session, application session, and any API token. NIST SP 800-63B describes authentication and session concepts; OWASP's session guidance covers application lifecycle. The product needs an explicit policy for reauthentication, logout propagation, and current role checks.
IdP-to-app timeline
| Event | IdP state | App check |
|---|---|---|
| Initial login | User authenticated | Create app session with current grants |
| App idle timeout | IdP may remain active | Decide whether silent renewal is allowed |
| Role removed | IdP claims change | Recheck before privileged effect |
| IdP logout | IdP session ends | Determine app-session invalidation |
| App logout | App cookie ends | State whether IdP remains signed in |
| Global disable | IdP blocks new login | Existing app session must follow policy |
Do not infer a universal single logout behavior. Some integrations do not send a logout event to each relying party. If the app needs immediate removal of a privileged role, use a current-state check or a revocation channel rather than waiting for a long token to expire.
Boundary test
Use a synthetic SSO user. Sign in and access an owned record. Log out at the IdP in another tab, then test the existing app session. Record whether it remains valid and whether that matches the product claim. Repeat after role removal, app logout, idle expiry, and global disable. Test a browser with two tabs and a queued job separately.
Capture timestamps, session IDs as safe hashes, response classes, and provider events. Do not store cookies or tokens. If logout propagation is delayed, state the measured bound and adjust the interface copy. A login screen appearing after a page refresh is not proof that an API token or open websocket has stopped working. Review the full path when the IdP or session library changes.
Make offboarding verifiable
Use the offboarding checklist to identify owners, revoke grants and verify the result. Discuss a scoped review of your application's access controls.
Sources
- NIST SP 800-63BAccessed
- OWASP Session Management Cheat SheetAccessed