I work on a software product that allows customers to use SAML or OAuth provisioning to their users. e.g to Azure AD.
Now non technical savvy users understandably presume that logging off from our software (the SP) would log them out. Because the SSO session still exists from the IDP it doesn't.
Their argument is that using a shared workstation and logging out leaves them exposed and without understanding that they need to sign out of their IDP on their workstation puts them at risk.
I'm of the understanding that this is a poor user experience due to the presumption logging out would log you out. Some SAML providers etc. facilitate a SP initiated single sign off from the IDP, but others don't.
Should I have a secondary "Log off from Idp" button that either triggers SP initiated log off or redirects to the IDP logout page to provide a better user experience? How would they know the difference and what this means?
Unsure what the best convention is around this that will help non tech savvy users as much as possible against leaving IDP accounts open on shared workstations. Or assist in explaining how SSO works as a SP.
Many companies use a SAML provider for their internal works and their customers, but often their customers only use that connection for a single SP and don't understand they are using a provider such as SAML. Our software facilitates for both internal staff users (who wouldn't want single sign off) and also external users in the same system who may or may not need the benefits of SSO.
I understand shared responsibility should mean the customers shared workstations should have sessions cleared after browser closure, but is there anything on our side that can assist here?