Overview - ISO/IEC 26137:2024 (OpenID Connect Back-Channel Logout 1.0)
ISO/IEC 26137:2024 standardizes an OpenID Connect back-channel logout mechanism (incorporating errata set 1). Built on OpenID Connect 1.0 and OAuth 2.0, it defines how an OpenID Provider (OP) can reliably notify Relying Parties (RPs) to terminate user sessions via direct server-to-server calls rather than via the end-user’s browser (front-channel). The standard specifies the format, delivery, and validation of a signed JSON Web Token (JWT) - the Logout Token - used to request logout, plus related discovery and registration metadata.
Key technical topics and requirements
- Logout Token (JWT):
- Must be signed; may be encrypted.
- Required claims: iss, aud, iat, exp, jti, events (containing http://schemas.openid.net/event/backchannel-logout).
- Session identification: must include either sub (subject) or sid (session id) - can include both.
- Prohibited: nonce claim MUST NOT be present.
- Recommended to include JWT header typ of logout+jwt; default signing alg is RS256 and alg "none" is disallowed.
- Back-channel delivery:
- OP triggers logout via HTTP POST to a registered backchannel_logout_uri using application/x-www-form-urlencoded with a logout_token parameter.
- OPs SHOULD avoid unnecessary retransmission and should retry only on recoverable errors with appropriate delays.
- Discovery & registration metadata:
- OP advertises support with backchannel_logout_supported and optional backchannel_logout_session_supported in OpenID Provider metadata.
- RPs register backchannel_logout_uri and may set backchannel_logout_session_required via dynamic client registration.
- Validation and processing:
- RPs MUST validate signature/encryption and standard claims (iss, aud, iat, exp, jti, events, sub/sid).
- RPs must implement application-specific session termination logic because browser state (cookies/local storage) is not available on the back-channel.
Practical applications and who should use this standard
- Identity providers (OPs) and SSO platform vendors implementing robust logout semantics across federated services.
- Relying parties (RPs) and web application architects that require reliable server-to-server logout notifications (e.g., enterprise SSO, banking, regulated sectors).
- Security architects, IAM teams, and developers integrating OpenID Connect with centralized session management across distributed systems.
- Use cases where browser-based front-channel logout is unreliable (background sessions, closed tabs) or where direct server-to-server confirmation is required.
Related standards
- OpenID Connect Core 1.0 (ID Tokens, claims)
- OpenID Connect Discovery and Dynamic Client Registration
- OpenID Connect Front-Channel Logout 1.0 and Session Management 1.0
- OAuth 2.0 (RFC 6749), JSON Web Token (JWT)
- Security Event Token (SET) and relevant IANA/RFCs referenced in the standard
By adopting ISO/IEC 26137:2024, implementers can add a standardized, interoperable back-channel logout flow to improve reliability and control of federated session termination.