Single Logout (SLO) Configuration between Drupal and AWS Cognito

This guide explains how to configure Single Logout (SLO) between your Drupal site and AWS Cognito using the miniOrange Drupal OAuth Client module.
Single Logout ensures that when a user logs out of Drupal, their session is also terminated on AWS Cognito.

Prerequisite:

• You will require the Enterprise Version of the module to configure the Single Logout feature.
• Before proceeding, ensure that the AWS Cognito App Client is properly configured and integrated with the miniOrange OAuth Client module on your Drupal site.
• OAuth login between Drupal and AWS Cognito is already working.

 Configure the Allowed Logout URL in AWS Cognito:

• Log in to the AWS Console and navigate to:
  Amazon Cognito → User Pools → [Your User Pool] → App Clients (in the left-hand navigation).
• Select your App Client (for example, drupal-oauth-login).
• Scroll down to the Login Pages section.
• In the Managed login pages tab, click Edit.
• Locate the Allowed sign-out URLs field and add your Drupal logout URL in the format:
  https://<your-drupal-site>/user/logout.
• Save the changes.

Configure the Logout Redirect in Drupal:

• Log in to your Drupal admin dashboard.
• Go to Configuration → miniOrange OAuth Client → Client Configuration.
• In the Client Settings section, scroll down to the Log out Settings.
• Check the box for Enable single log out.
• Enter the redirect URL in the IDP End Session Endpoint ​​​​​​text field in the following format: https://<your-cognito-domain>.auth.<region>.amazoncognito.com/logout?client_id=<client-id>&.
• After that, enter the logout URI parameter in the Redirect URI Param Name of Identity Provider text field, like logout_uri=https://<your-drupal-site>/user/logout.
• Replace:
  • <your-cognito-domain> with your Cognito domain.
  • <region> with your AWS region.
  • <client-id> with your Cognito App Client ID.
  • <your-drupal-site> with your site’s base URL.

• Once both configurations are saved, test the Single Logout to ensure everything is working correctly.

 Back to top