# Federated logout of IDP **URL:** \ **Category:** Questions\ **Created:** [October 30, 2019, 7:56pm UTC](https://devforum.okta.com/t/federated-logout-of-idp/6748 "2019-10-30T19:56:04Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Eric](https://avatars.discourse-cdn.com/v4/letter/e/898d66/32.png) [@Eric](https://devforum.okta.com/u/Eric)\ **Post date:** [October 30, 2019, 7:56pm UTC](https://devforum.okta.com/t/federated-logout-of-idp/6748/1 "2019-10-30T19:56:04Z")
I am using the Org2Org app to configure a hub and spoke scenario to allow SSO into a parent company Okta ORG, while being able to configure the hub ORG independently for our company. The spoke ORG is configured as an IDP in the hub ORG, and the application in question has routing rules to direct all login attempts to the spoke ORG. For sign-on, this is working well. When a login request comes into our hub, the routing rules direct them to the spoke IDP to enter credentials and drop a cookie. Logging into a second app (or even an app targeting the parent company org directly) works perfectly with SSO due to the cookie placed in the parent ORG domain. The issue I am facing is when attempting to sign out of our application. I currently clear the local session in the app, and then redirect to the hub org to logout. This removes the cookie in the hub domain, but does not log the user out of the spoke (parent company ORG). If the user navigates back to the application, they are immediately logged in because the session still exists on the parent IDP (spoke ORG). This essentially makes it impossible to log out of our app, unless the user navigates to the parent ORG and logs out manually. But that would require the app to have knowledge of the parent IDP to redirect the user there. Both Identity Server and Auth0 handle this case by automatically redirecting to the parent IDP logout endpoint if the current session was initiated by an IDP (Auth0 has an optional ‘Federated’ parameter that can be supplied in the logout request). Is there anything like that in OKTA, or are there any other suggestions on how to completely log the user out of the entire session hierarchy? To be clear, I’m not worried about the user seamlessly being logged out of all applications. I’m just need them to be able to log out of the parent IDP, so the app doesn’t immediately log back in. ---
**Author:** ![coloradotrav](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/coloradotrav/32/1878_2.png) [@coloradotrav](https://devforum.okta.com/u/coloradotrav)\ **Post date:** [May 22, 2020, 11:36pm UTC](https://devforum.okta.com/t/federated-logout-of-idp/6748/2 "2020-05-22T23:36:15Z")
Did you ever find a solution. We have the same problem. ---
**Author:** ![hitesh](https://avatars.discourse-cdn.com/v4/letter/h/8e7dd6/32.png) [@hitesh](https://devforum.okta.com/u/hitesh)\ **Post date:** [February 11, 2021, 7:56pm UTC](https://devforum.okta.com/t/federated-logout-of-idp/6748/3 "2021-02-11T19:56:12Z")
Is there any solution for this problem? I am facing a similar issue. ---
**Author:** ![mikessun](https://avatars.discourse-cdn.com/v4/letter/m/d6d6ee/32.png) [@mikessun](https://devforum.okta.com/u/mikessun)\ **Post date:** [December 2, 2021, 5:10am UTC](https://devforum.okta.com/t/federated-logout-of-idp/6748/4 "2021-12-02T05:10:08Z")
Hi Okta expert, could you please answer the question here? we have the same issue, e.g., when a federated user log out from internal application, we want to the user logging out from the internal app, the Okta tenant and the IdP. for internal app and Okta logout: seems handled by Okta SLO what’s the best practice to log out the user from IdP? ---
**Author:** ![nikicc](https://avatars.discourse-cdn.com/v4/letter/n/59ef9b/32.png) [@nikicc](https://devforum.okta.com/u/nikicc)\ **Post date:** [September 13, 2022, 9:34pm UTC](https://devforum.okta.com/t/federated-logout-of-idp/6748/5 "2022-09-13T21:34:24Z")
We have the same issue. Any updates to this thread perhaps? ---
**Author:** ![SimonTurner](https://avatars.discourse-cdn.com/v4/letter/s/cdc98d/32.png) [@SimonTurner](https://devforum.okta.com/u/SimonTurner)\ **Post date:** [October 3, 2023, 8:43am UTC](https://devforum.okta.com/t/federated-logout-of-idp/6748/6 "2023-10-03T08:43:54Z")
Same issue. Has anyone got anywhere with this? ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [February 13, 2024, 12:30am UTC](https://devforum.okta.com/t/federated-logout-of-idp/6748/7 "2024-02-13T00:30:51Z")