
### Introduction {#Introduction}

 We have all done it  - we log into a service - that too on a shared device - and when we’re done with it, we simply close the browser tab and walk away thinking we’ve been automatically logged out, since an active session does not exist anymore. This is like unlocking the door to your house, and leaving the keys in the lock when you leave. Not a secure way to live, is it now?

But maybe you’re a bit smarter than the average joe, and you do remember to log out from a shared device once you’re done with it. But what if the system you’re using isn't that smart? 
You log out of one app only to discover you're still signed in on another.

That’s a Zombie Session. Still alive, and still accessible. One of the scariest gaps in your site's security. They are an open invitation for misuse and theft. 

**And Attackers love forgotten sessions.**

But there is a solution - a long lived concept - Single Logout or SLO, for short. This is nothing new. But we’ve gone a step further and have given it a glow-up. 

When a user manually logs out, the drupal session is terminated and assuming SLO is configured, the IDP session would be terminated as well. We just add bit out added security, and invalidate the token to prevent misuse. 

The new and improved miniOrange Drupal OAuth Client Module, makes SLO smarter, by linking user sessions directly to the Access or ID token - specifically the token expiry. This automatically triggers SLO when your token expires. 

That brings us to idle sessions. They need to be handled separately. We can take care of it using a setting in the Session Management module - the auto-logout. 
You can set a threshold value (in seconds) for inactivity, and if a user remains inactive beyond the configured time, auto-logout will take place first, and then SLO will follow to ensure the session is fully terminated from the IdP side as well. 

Let’s take a look at the components involved:  

###  What’s an ID Token? {#What’s-an-ID-Token?} 

You can think of it as your temporary pass/token - it is a digitally signed piece of information issued by the IdP after a user is successfully authenticated via something like OIDC. It contains details like the user’s identity, authentication time, and a set expiry. 

###  How long does a session last or what is Session Timeout? {#What-is-Session-Timeout-or-what-is-Session-Timeout?}

Session Timeout - It defines how long a user’s login session remains active on a site/application before it expires. By default, drupal has its own session timeouts. But with OAuth client, the drupal session timeout is directly synchronized with the Access or ID token expiry. 

###  What is Single Log Out? {#What-is-Single-Log-Out?}

Single Log Out (SLO) is a process that ends active sessions across all connected applications in one go. When triggered, it logs the user out from not just SP, but also from the Identity Source, and based on the configurations IDP - any other apps linked to it.

###  Smarter SLO {#Smarter-SLO}

You can configure SLO through the **miniOrange Drupal OAuth Client** Module. [Here’s the link](https://www.drupal.org/docs/contributed-modules/drupal-oauth-openid-connect-login-oauth2-client-sso-login/oauth-feature-handbook/single-logout-slo-configuration-between-drupal-and-okta) to a guide that outlines how you can configure SLO between Drupal and Okta. 

This is where it gets better - 
The OAuth Server issues an Access or ID Token when a user signs in. That token has a set expiry, that’s standard. 
When a user logs in, their session is created in Drupal. This session too, has a defined expiry. 

What if the *expiries* were to figuratively sync up? 

The OAuth Client Module, reads the token expiry and when the token expires, the module kills the Drupal session as well.
And now, the SLO comes into play to log the user out of other connected apps too (again, this depends on the IDP / OAuth Provider you’re using) - for example, logging out of your Gmail session, kills all sessions across YouTube, Google Sheets and the entire suite of apps, connected to Google - the Identity Source. 

The beauty of this feature? You don’t have to configure timeouts in a dozen places. The IdP sets the rule (default: 60 mins), and Drupal follows it. 


**The bottom line?**

No extra clicks. No zombie sessions. No loose ends. 

Users don't have to wonder if they are still logged in somewhere.
As there would be no forgotten sessions there would be fewer attack opportunities.

And.. that’s pretty much it: 
Your risk of zombie sessions is eliminated; your site stays secure and your sessions stay in sync.
 
If you’re already a part of our miniOrange Drupal Community, upgrade to the [latest version](https://portal.miniorange.com/downloads) right away. 
If not, we’d love to have you on-board! 

Here’s a [link](https://plugins.miniorange.com/drupal-sso-oauth-openid-single-sign-on) to know more. But if you’d like this out for a test drive, we can get you set up with a 7-day trial.

Discover how Single Logout (SLO) in Drupal enhances security by syncing session expiry with token expiry. Eliminate dormant sessions, prevent misuse, and ensure secure logouts across all connected applications.

Redefining SLO - Secure Logouts


### What it is and What it could be {#What it is and What it could be}

Right now, the world’s split into 2 - one half has got cash to throw at the most expensive solution, hoping it would be the best there is; and the other half never seems to have enough cash lying around that can be spent on a security solution. 

But there’s one thing that unites both these classes, it is their pre-existing infrastructure. Okay maybe there are 2 things. Both classes fail to realize that the set-up that they’ve already got - the website; presumably built on Drupal - the best CMS there is when it comes to security - and the associated database - can in itself become the source for Identity Verification or in other words, Drupal becomes your Identity Provider (IdP). 

### Unmasking Cloud IdPs {#Unmasking Cloud IdPs}

When faced with the daunting task of setting up a centralized Identity Management System, most people turn to providers like Azure AD, Okta and Ping Identity to name a few.
While there’s nothing inherently wrong with choosing these products - they exist for a reason, they have a great product that has stood strong for tens of years. But what the average consumer of these services do not realize, is how quickly the costs can add up. 

Maybe you’re someone who is into finance, maybe not, but there’s this concept of NDR - Net Dollar Retention - which literally means how much a customer is paying year over year. Any NDR over 100% is a sign of growth and expansion of business. There are many ways to achieve a 100%+ NDR, you cross-sell or you up-sell, but the easiest way might just be to simply jack up the prices. That is what the leaders tend to do - and they can get away with it, just because there’s nowhere for the users to go, there isn’t a better alternative out there. Well, until now. 

### Why On-Prem Drupal IdP {#Why On-Prem Drupal IdP}

IdPs like Okta and Azure are feature-rich no doubt, but they’re often priced for large organizations. miniOrange provides a powerful, scalable alternative that doesn’t break your bank; and the added benefit - it sits right in your Drupal Ecosystem!

Let’s talk numbers:

**Cloud SaaS Solutions:** $5 to $15 per user per month - That’s anywhere between $6000 to $18000/year for 100 users. Even if we consider a non-linear pricing model, a 50% reduction would still mean an annual cost of anywhere between $3000 and $9000. 

**[On-Prem Drupal as IdP](https://plugins.miniorange.com/drupal-saml-idp):** $450/year for 100 users.
That's over 90% savings, without compromising on security or features. It's got all things you’d expect out of a full-fledged cloud IdP -
   1. Adaptive Authentication? Check! 
   2. Protocol Agnostic - If you’re a [SAML](https://plugins.miniorange.com/drupal-saml-idp) junkie or an [OAuth](https://plugins.miniorange.com/drupal-oauth-server) groupie, it can do both! Check, and Check!
   3. Auditing, Logging and [Session Monitoring](https://plugins.miniorange.com/drupal-session-management)? We got that too!
   4. In-built MFA support? Yep, it’s got that as well

There’s a pretty significant trade off while choosing between a cloud or an on-premise solution - especially when it comes to authentication & user security. One often-overlooked but critical factor in this decision is data residency.

With the rampant expansion of the AI landscape, where the ethics of AI crawlers are questionable, you should ask yourself is your cloud hosted data really private?

Why not shift to a solution that is completely within your control? A solution that can work without any external connectivity, a solution that gives you your very own inhouse IdP without the pesky setup, a solution that makes financial and technological sense.

When it comes to creating an IdP within Drupal, there are solutions including the likes of us where everything is deployed completely on-premise, within your own infrastructure - with no risk of user data exposure or a leak. The entire identity flow stays inside your environment, giving you complete control over your security setup - nothing ever leaves your system.


### Put your money where it matters {#Put your money where it matters}

This level of control is not just a bonus, it's elementary - almost mandatory, especially if you're aiming for SOC2 compliance, or operating in an environment where data sovereignty is a legal or internal mandate.

And if you need even more convincing, here’s the kicker - by going for these solutions - you're just not improving security; you're saving a ton to what you'd otherwise be spending on external identity services. 
The money you save just doesn't disappear, it can be redirected to something more meaningful, like adding advanced capabilities such as a [PAM](https://www.miniorange.com/pam/) solution, or maybe even back into your team - because who doesn’t like a fatter wallet? Sometimes the best investment you can do is just giving your employees a well-deserved raise.

**The bottom line?**

You don't have to overspend to get a reliable and secure IAM solution, without - now you have the power, you can do it all - we believe in you!


Tired of high costs from cloud-based Identity Providers? Learn how your Drupal site can become a secure, affordable on-premise Identity Provider (IdP) saving money and giving you full control.

Drupal CMS Security

Redefining SLO - Secure Logouts

How You Can Save Big With Drupal As Your Identity Provider