User sessions

User sessions

When a user signs in to an application through TrustBuilder, TrustBuilder creates a session for that user.

A TrustBuilder session represents the authenticated user and can be shared across multiple applications integrated with the same TrustBuilder tenant. As long as the session remains active, the user can access participating applications without being prompted to authenticate again, depending on the application's authentication policy.

The session ends when it expires (1hour) or when the user signs out.

Single Logout (SLO)

Single Logout (SLO) allows a user to terminate a TrustBuilder session by signing out from a single application. When a logout is initiated, TrustBuilder ends the user's session and propagates the logout to every participating application that shares the same session.

1. When a user signs out from an application, the application sends a logout request to TrustBuilder to initiate the Single Logout process.
   For SAML applications, the Logout Request must be signed using the Service Provider's signing certificate configured in the SP metadata. Unsigned or invalid requests are rejected.

2. TrustBuilder identifies the user's session using information provided in the logout request:

   • for OIDC → id_token_hint with the sub and sid claims,
     or

   • for SAML → NameID and SessionIndex values.
     If the required information is missing or invalid, the logout cannot be propagated.

3. Once the session has been identified, TrustBuilder terminates the user's session.

4. TrustBuilder identifies all applications associated with the terminated session and propagates the logout.
   The propagation mechanism depends on the protocol used by each participating application:

   • for OIDC participating applications: Trustbuilder revokes the tokens.

   • for SAML participating applications : TrustBuilder sends a signed SAML Logout Request to their configured Single Logout endpoint.

5. Participating applications process the logout action and terminate their local user session.

   • For OIDC applications, the logout becomes effective once the current access token expires, as revoked tokens can no longer be refreshed.

   • for SAML applications, the application returns a signed LogoutResponse to TrustBuilder.

6. TrustBuilder returns a response to the application that initiated the logout, indicating whether the operation completed successfully.