diff --git a/cas.routing.yml b/cas.routing.yml
index d7e8b51..95fc9fd 100644
--- a/cas.routing.yml
+++ b/cas.routing.yml
@@ -11,21 +11,29 @@ cas.login:
     _controller: '\Drupal\cas\Controller\ForceLoginController::forceLogin'
   requirements:
     _access: 'TRUE'
+  options:
+    _maintenance_access: TRUE
 cas.service:
   path: '/casservice'
   defaults:
     _controller: '\Drupal\cas\Controller\ServiceController::handle'
   requirements:
     _access: 'TRUE'
+  options:
+    _maintenance_access: TRUE
 cas.proxyCallback:
     path: '/casproxycallback'
     defaults:
       _controller: '\Drupal\cas\Controller\ProxyCallbackController::callback'
     requirements:
         _access: 'TRUE'
+    options:
+      _maintenance_access: TRUE
 cas.logout:
   path: '/caslogout'
   defaults:
     _controller: '\Drupal\cas\Controller\LogoutController::logout'
   requirements:
     _access: 'TRUE'
+  options:
+    _maintenance_access: TRUE
diff --git a/cas.services.yml b/cas.services.yml
index 2b99437..2c37404 100644
--- a/cas.services.yml
+++ b/cas.services.yml
@@ -18,3 +18,8 @@ services:
   cas.proxy_helper:
     class: Drupal\cas\Service\CasProxyHelper
     arguments: ['@http_client', '@cas.helper']
+  cas.route_enhancer:
+    class: Drupal\cas\Routing\CasRouteEnhancer
+    arguments: ['@cas.helper']
+    tags:
+      - { name: route_enhancer }
diff --git a/config/install/cas.settings.yml b/config/install/cas.settings.yml
index 73e3fac..963d528 100644
--- a/config/install/cas.settings.yml
+++ b/config/install/cas.settings.yml
@@ -24,5 +24,8 @@ proxy:
 user_accounts:
   auto_register: false
 
+logout:
+  cas_logout: false
+
 debugging:
   log: false
diff --git a/config/schema/cas.schema.yml b/config/schema/cas.schema.yml
index 95318d3..af670a7 100644
--- a/config/schema/cas.schema.yml
+++ b/config/schema/cas.schema.yml
@@ -50,6 +50,13 @@ cas.settings:
         auto_register:
           type: boolean
           label: 'Auto Register Users'
+    logout:
+      type: mapping
+      label: 'Logout'
+      mapping:
+        cas_logout:
+          type: boolean
+          label: 'Drupal Logout Triggers CAS Logout'
     proxy:
       type: mapping
       label: 'Proxy'
diff --git a/src/Form/CasSettings.php b/src/Form/CasSettings.php
index 88f1e66..d1a4d04 100755
--- a/src/Form/CasSettings.php
+++ b/src/Form/CasSettings.php
@@ -173,6 +173,19 @@ class CasSettings extends ConfigFormBase {
       '#default_value' => $config->get('user_accounts.auto_register'),
     );
 
+    $form['logout'] = array(
+      '#type' => 'details',
+      '#title' => $this->t('Logout'),
+      '#open' => FALSE,
+      '#tree' => TRUE,
+    );
+    $form['logout']['cas_logout'] = array(
+      '#type' => 'checkbox',
+      '#title' => $this->t('Drupal Logout Triggers CAS Logout'),
+      '#description' => $this->t('When enabled, a Drupal user logout will cause a CAS logout.'),
+      '#default_value' => $config->get('logout.cas_logout'),
+    );
+
     $form['redirection'] = array(
       '#type' => 'details',
       '#title' => $this->t('Redirection'),
@@ -304,6 +317,8 @@ class CasSettings extends ConfigFormBase {
       ->set('proxy.proxy_chains', $form_state->getValue(['proxy', 'proxy_chains']));
     $config
       ->set('user_accounts.auto_register', $form_state->getValue(['user_accounts', 'auto_register']));
+    $config
+      ->set('logout.cas_logout', $form_state->getValue(['logout', 'cas_logout']));
 
     $config
       ->set('debugging.log', $form_state->getValue(['debugging', 'log']));
diff --git a/src/Routing/CasRouteEnhancer.php b/src/Routing/CasRouteEnhancer.php
new file mode 100644
index 0000000..929a0fe
--- /dev/null
+++ b/src/Routing/CasRouteEnhancer.php
@@ -0,0 +1,50 @@
+<?php
+
+/**
+ * @file
+ * Contains \Drupal\cas\Routing\CasRouteEnhancer.
+ */
+
+namespace Drupal\cas\Routing;
+
+use Drupal\Core\Routing\Enhancer\RouteEnhancerInterface;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\Routing\Route;
+use Drupal\cas\Service\CasHelper;
+
+class CasRouteEnhancer implements RouteEnhancerInterface {
+  
+  /**
+   * @var \Drupal\cas\Service\CasHelper
+   */
+  protected $casHelper;
+  
+  /**
+   * Constructor.
+   *
+   * @param CasHelper $cas_helper
+   *   The CAS helper service.
+   */
+  public function __construct(CasHelper $cas_helper) {
+    $this->casHelper = $cas_helper;
+  }
+  
+  /**
+   * {@inheritdoc}
+   */
+  public function enhance(array $defaults, Request $request) {
+    if ($this->casHelper->provideCasLogoutOverride($request)) {
+      $defaults['_controller'] = '\Drupal\cas\Controller\LogoutController::logout';
+    }
+
+    return $defaults;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function applies(Route $route) {
+    return ($route->getPath() == '/user/logout');
+  }
+
+}
diff --git a/src/Service/CasHelper.php b/src/Service/CasHelper.php
index 69b24aa..a2ce92a 100644
--- a/src/Service/CasHelper.php
+++ b/src/Service/CasHelper.php
@@ -5,6 +5,7 @@ namespace Drupal\cas\Service;
 use Drupal\Core\Config\ConfigFactoryInterface;
 use Drupal\Core\Routing\UrlGeneratorInterface;
 use Drupal\Component\Utility\UrlHelper;
+use Drupal\Component\Utility\Crypt;
 use Drupal\Core\Database\Connection;
 use Drupal\Core\Logger\LoggerChannelFactory;
 use Drupal\Core\Logger\LoggerChannel;
@@ -383,4 +384,42 @@ class CasHelper {
   protected function isExternal($url) {
     return UrlHelper::isExternal($url);
   }
+
+  /**
+   * Check if the current logout request should be served by caslogout.
+   *
+   * @param \Symfony\Component\HttpFoundation\Request $request
+   *   The request instance.
+   *
+   * @return bool
+   *   Whether to process logout as caslogout.
+   */
+  public function provideCasLogoutOverride($request) {
+    if ($this->settings->get('logout.cas_logout') == TRUE) {
+      if ($this->isCasSession($request->getSession()->getId())) {
+        return TRUE;
+      }
+    }
+
+    return FALSE;
+  }
+
+  /**
+   * Check if the given session ID was authenticated with CAS.
+   *
+   * @param string $session_id
+   *   The session ID to look up.
+   *
+   * @return bool
+   *   Whether or not this session was authenticated with CAS.
+   */
+  public function isCasSession($session_id) {
+    $results = $this->connection->select('cas_login_data')
+      ->fields('cas_login_data', array('sid'))
+      ->condition('sid', Crypt::hashBase64($session_id))
+      ->execute()
+      ->fetchAll();
+    
+    return !empty($results);
+  }
 }