title: Identity Server 4 and multiple client apps
body: <p>I'm developing SSO authority (something like FB or Google) and other client applications will use it to authenticate a user. I encountered the following problem.
  I have 2 client apps (Identity Server clients) - ClientA and ClientB. Now single user User1 logs on into ClientA web app. He enters user/password and tokens are issued for User1/ClientA combination. 
  Then User1 logs on into ClientB application. There is no login dialog, which is fine, as cookies are used by Identity Server to recognize the same session. The token endpoint is called to issues tokens for a User1/ClientB combination.</p>
  
  <p>There is a problem with logout. I log out from ClientA app which cancels the session for this user (SubjectId) also on Identity Server (by calling HttpContext.SignOutAsync("oidc")).
  Now, what should happen to ClientB application? I found some queries about this issue and most people want other applications to sign out too (using front-channel or back-channel) but I want other apps to continue running as signed-in. From my point of view, this is the same scenario like when you log in to StackOverflow using FB than you log in to e.g. Tripadvisor using FB and when you log-out from one of this sites you will be still logged on to other sites.
  In my case ClientB is still functional, it has valid tokens and can call back-end APIs. But when I initiate the same logout from ClientB then Identity server is not happy with that as it cannot find this SubjectId:</p>
  
  <p><em>Processing signout request for anonymous...</em><br>
  <em>End session request validation failure: Error validating id token hint...</em></p>
  
  <p>Why is identity server considering these 2 applications as one session and delete it when one application is signed out? What is the recommended approach in this case?</p>
  
  <p>Thanks</p>
  
  <p>Peter</p>