Skip to main content

User logout stage

The User Logout stage ends the user's authentik session and, if configured, initiates Single Logout.

Overview​

This stage removes the current authentik session. When Single Logout is enabled for SAML or OIDC providers, authentik can also inject additional logout handling for those provider sessions.

Configuration options​

This stage has no stage-specific configuration options.

Flow integration​

The default flows use this stage differently:

  • default-invalidation-flow: used when the user logs out directly from authentik. This flow includes the User Logout stage.
  • default-provider-invalidation-flow: used when a logout starts from an application. This flow does not include the User Logout stage by default.

Add the User Logout stage to default-provider-invalidation-flow if RP-initiated logout should also end the main authentik session.

Notes​

When this stage runs, authentik can inject additional logout stages for active provider sessions:

  • front-channel iframe logout stages
  • front-channel native logout stages
  • back-channel logout execution

This enables automatic provider-specific logout without manually adding those stages to the flow.