Does Samly manages users getting logged out if their permissions are revoked in their IDP?

handnot2 / samly

Elixir Plug library to enable SAML 2.0 SP SSO in Phoenix/Plug applications.

MIT License

125 stars 90 forks source link

Does Samly manages users getting logged out if their permissions are revoked in their IDP? #57

Open messutied opened 3 years ago

messutied commented 3 years ago

So if a user has access in OKTA (for example) to use a given app (Samly SSO enabled), they successfully sign in and later their permissions to that app are revoked, it seems like the user remains logged in through Samly, it looks like notonorafter could be used for automatically expiring the sessions, is this something we should take care of outside of Samly? or am I missing something?

Thanks!