We're developing ODC mobile apps integrated with Entra ID for SSO, and we found the following senarios the logout was not working:
1. We configured the Idle Session Duration is set to the default of 12 hours for the external IDP with Entra ID. After user idled for 12 hours, the entra ID session was terminated due to idle for 12 hours. However when user open the app, they still can operate with the app, if user click logout button, the logout flow completed and stayed in you are logged out. However, the user was not logout with the ODC mobile app, after close the browser it stayed in the last page of the app.
Similar issue for below:
2. Use another web app using our company's Entra ID sso, and try to logout ODC mobile app
3. Using multiple ODC Mobile APP on the same device, if logout the first app successfully, then the other app will stayed in logged in status.
How can this be resolved? As our company using Shared Devices for the mobile apps, logout function is critical that user working on shift jobs would using the same devices for ODC mobile app, and they need logout feature to switch user and ensure security and compliance.
Thanks
Julie
Hello @Julie Lan
If I remember well...
Reactive applications (as well as Mobile applications) do not know when the session has finished, as session ending happens server-side.
As long as there is no request to the server, the application will keep "working".
You can check this: Open a mobile application. Login in. Open a second mobile application (you should be able to enter it without doing login, as you are already logged in from the first app).
Now, logout on one of them and go back to the other. You will have the result you are telling: It seems you are still logged in.
But you are not. Server side you are not logged anymore. Try to navigate to a screen (not anonymous) that fetch data from the server or try to execute an action that calls a server action (that validates a role). You should be redirected to the Login flow, because the server will tell the app that you are not logged anymore.
If you want, you can improve this. There is a system client action you can use that is called every time the application comes back to the foreground. You can than check if the user is still logged in with a call to the server, for example and automatically redirect the user to the login screen if not.
This also work in Reactive Applications.Hope this helps.Cheers!