Multiple Applications Integrated With Oracle Identity Cloud Service (IDCS) VIA An IIS WebGate - Logout Not Clearing Cookies Correctly (Doc ID 2806715.1)

Last updated on DECEMBER 21, 2022

Applies to:

Symptoms

Logout doesn't clear the cookie for second application. So when user re-login, they see information of first user on  second application (since it is using old cookie)

• Two applications that are integrated with Oracle Identity Cloud Service (IDCS) via an IIS Webgate and a confidential application in IDCS
• Need the logout from one application to trigger logout from both applications (i.e. deleting the user's session in both places). 

Scenario
1. Access and log into <APP_1> as <USER_1>
2. Access <APP_2> (No challange for authentication, as expected)
3. Click on "client app" to switch back to  <App_1> from within same browser/tab
4. Logout from  <APP_1>
5. Log into  <APP_1>  as <USER_2>
6. Go to <APP_2>, where it shows the <USER_1> instead of <USER_2>

• Issue is not seen if an Apache Web Server is used

Changes

Cause

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.