title: Single sign off using OAuth 2
body: <p>We just have been discussing the login and logout behaviour when using OAuth 2. Let's say we have two webapps <code>A</code> and <code>B</code> using one OAuth provider <code>O</code> (built using the spring-security-oauth2 stack).</p>
  
  <p>When you want to login to <code>A</code> you get redirected to <code>O</code>, enter your credentials, get a session there on <code>O</code>, redirected back to <code>A</code> with an access token and a session is created on <code>A</code> as well.</p>
  
  <p>Now when you want to login to <code>B</code> you get redirected to <code>O</code>, get directly sent back with a token to B because you still have a valid sesison on <code>O</code> and a session is created on <code>B</code> as well (without having to enter your credentials again).</p>
  
  <p>This solves our single sign on problem. </p>
  
  <p>A requirement now is, that when logging out from <code>A</code> <em>or</em> <code>B</code> you are logged out always from both/all apps (single sign off).</p>
  
  <p>Our idea is:</p>
  
  <ul>
  <li>Enhance the access token with the current session id</li>
  <li>If apps <code>A</code> or <code>B</code> want to logout a user, they redirect him to the logout page of <code>O</code></li>
  <li>If the user gets logged out from <code>O</code>, all access tokens belonging to the current session on <code>O</code> are removed and the user gets redirected back to <code>A</code> or <code>B</code></li>
  <li>The session on <code>A</code> or <code>B</code> gets destroyed</li>
  <li><code>A</code> and <code>B</code> check for the validity of their OAuth access token on each request and destroy their session if the token is not valid any more</li>
  </ul>
  
  <p>Do you think this is a valid use case for OAuth 2? How you would you implement single sign off differently?</p>