Glossary
Single Sign-Out
Single sign-out propagates a logout across every application a federated identity was signed into, rather than ending only the session in the specific application where the user clicked logout. Without it, a user reasonably believing they've logged out everywhere may still have live, authenticated sessions active in other applications that never received any signal that the underlying identity had signed out.
This is considerably harder to implement reliably than single sign-on itself: it requires the identity provider to notify every relying application of the logout event, and each application to actually act on that notification promptly — a chain with more points where something can silently fail than the original login flow has, and one that's noticed far less often precisely because a session that fails to end quietly just keeps working.