From 0e31e9c3121ac65dca771f93ee2d35f0ba52d75e Mon Sep 17 00:00:00 2001 From: Jonathan Roebuck Date: Mon, 13 Apr 2026 16:25:09 +0100 Subject: [PATCH 1/2] docs: clarify Auth0 logout changeset description The original changeset implied the logout redirect only happens when federatedLogout is true. In reality, sign-out always redirects to Auth0's /v2/logout to clear the Auth0 session cookie. The federatedLogout flag only controls whether the upstream IdP session is also terminated. Co-Authored-By: Claude Opus 4.6 (1M context) Signed-off-by: Jonathan Roebuck --- .changeset/auth0-federated-logout.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.changeset/auth0-federated-logout.md b/.changeset/auth0-federated-logout.md index 83dda17a71..f073c574ca 100644 --- a/.changeset/auth0-federated-logout.md +++ b/.changeset/auth0-federated-logout.md @@ -2,4 +2,6 @@ '@backstage/plugin-auth-backend-module-auth0-provider': minor --- -Added federated logout support. Set `federatedLogout: true` in the Auth0 provider config to clear both the Auth0 session and any upstream IdP session on sign-out. The authenticator returns a logout URL that redirects the browser to Auth0's `/v2/logout?federated` endpoint, ensuring users must fully re-authenticate after signing out. +Sign-out now redirects the browser to Auth0's `/v2/logout` endpoint, clearing the Auth0 session cookie so that users must re-authenticate on next sign-in. Previously, only the Backstage session was cleared, allowing users to sign back in without re-entering credentials. + +Set `federatedLogout: true` in the Auth0 provider config to additionally clear the upstream IdP session (e.g. Okta, Google), requiring full re-authentication across the entire SSO chain. From 698a835ab6c00a7e43bfa6423d61921daf04358b Mon Sep 17 00:00:00 2001 From: Jonathan Roebuck Date: Mon, 13 Apr 2026 17:12:13 +0100 Subject: [PATCH 2/2] Update .changeset/auth0-federated-logout.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Jonathan Roebuck --- .changeset/auth0-federated-logout.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.changeset/auth0-federated-logout.md b/.changeset/auth0-federated-logout.md index f073c574ca..cddc1661ab 100644 --- a/.changeset/auth0-federated-logout.md +++ b/.changeset/auth0-federated-logout.md @@ -2,6 +2,6 @@ '@backstage/plugin-auth-backend-module-auth0-provider': minor --- -Sign-out now redirects the browser to Auth0's `/v2/logout` endpoint, clearing the Auth0 session cookie so that users must re-authenticate on next sign-in. Previously, only the Backstage session was cleared, allowing users to sign back in without re-entering credentials. +Sign-out now redirects the browser to Auth0's `/v2/logout` endpoint, clearing the Auth0 session cookie so that the next sign-in creates a new Auth0 session. Previously, only the Backstage session was cleared, allowing users to sign back in without going through Auth0 logout first. -Set `federatedLogout: true` in the Auth0 provider config to additionally clear the upstream IdP session (e.g. Okta, Google), requiring full re-authentication across the entire SSO chain. +Set `federatedLogout: true` in the Auth0 provider config to additionally clear the upstream IdP session (e.g. Okta, Google). This is what guarantees a full re-login across the entire SSO chain and may require users to re-enter credentials.