From 0e31e9c3121ac65dca771f93ee2d35f0ba52d75e Mon Sep 17 00:00:00 2001 From: Jonathan Roebuck Date: Mon, 13 Apr 2026 16:25:09 +0100 Subject: [PATCH] docs: clarify Auth0 logout changeset description The original changeset implied the logout redirect only happens when federatedLogout is true. In reality, sign-out always redirects to Auth0's /v2/logout to clear the Auth0 session cookie. The federatedLogout flag only controls whether the upstream IdP session is also terminated. Co-Authored-By: Claude Opus 4.6 (1M context) Signed-off-by: Jonathan Roebuck --- .changeset/auth0-federated-logout.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.changeset/auth0-federated-logout.md b/.changeset/auth0-federated-logout.md index 83dda17a71..f073c574ca 100644 --- a/.changeset/auth0-federated-logout.md +++ b/.changeset/auth0-federated-logout.md @@ -2,4 +2,6 @@ '@backstage/plugin-auth-backend-module-auth0-provider': minor --- -Added federated logout support. Set `federatedLogout: true` in the Auth0 provider config to clear both the Auth0 session and any upstream IdP session on sign-out. The authenticator returns a logout URL that redirects the browser to Auth0's `/v2/logout?federated` endpoint, ensuring users must fully re-authenticate after signing out. +Sign-out now redirects the browser to Auth0's `/v2/logout` endpoint, clearing the Auth0 session cookie so that users must re-authenticate on next sign-in. Previously, only the Backstage session was cleared, allowing users to sign back in without re-entering credentials. + +Set `federatedLogout: true` in the Auth0 provider config to additionally clear the upstream IdP session (e.g. Okta, Google), requiring full re-authentication across the entire SSO chain.