search

department-of-veterans-affairs / va.gov-team

Public resources for building on and in support of VA.gov. Visit complete Knowledge Hub:
https://depo-platform-documentation.scrollhelp.site/index.html
283 stars 203 forks source link

Update VA.gov sign out to use IAM Global Logout #33281

Closed nsoutouras closed 2 years ago

nsoutouras commented 2 years ago

VA.gov should use IAM's Global Logout endpoint instead of the existing PKMS sign out. Documented here: https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/SSOe/Session%20Termination.aspx

What Should Happen Upon clicking sign out, the user's session should be terminated across all IAM SSOe partners (IAM is responsible for this functionality). Usage of this endpoint should continue to redirect users back to VA.gov; there should be no change to the end user experience (other than session being terminated across VA web properties).

URL structure should be as follows (per IAM / documentations)

Logout and redirect to Application Unauthenticated Page: https://<env>.eauth.va.gov/slo/globallogout?appKey=<KEY> where KEY is URLEncoded application key value from the SSOe configuration (for AccessVA integrated applications this is the same as the ...?cspSelectFor=<appKey>)

VA.gov appKey: iDev > https%3A%2F%2Fssoe-sp-dev.va.gov SQA > https%3A%2F%2Fssoe-sp-staging.va.gov Prod > https%3A%2F%2Fssoe-sp-prod.va.gov

This is currently live in iDev and will be pushed to other envs by IAM shortly.

codyreinold-usds commented 2 years ago

This is currently live in iDev and SQA. Anticipated launch to production by IAM is Thursday. We should release to production shortly after the IAM release (Friday / Monday), but cannot release before--otherwise users will land on an eauth page once signed out.

bramleyjl commented 2 years ago

Production change was made today: https://github.com/department-of-veterans-affairs/devops/pull/10351