Enable Okta Universal Logout for ScribbleMaps
Who can use this feature
- Okta Admins
- Supported via the Okta Admin dashboard
Overview
As an Okta Admin, you can leverage Okta's Universal Logout feature to trigger logout from Okta and extend it to ScribbleMaps. Because ScribbleMaps is included in the Okta Integration Network (OIN) app catalog, you only need to enable it through the Okta dashboard.
Universal Logout is supported by default in ScribbleMaps for any team with SSO (SAML or OIDC) configured. No additional configuration is required within ScribbleMaps.
When Okta detects an identity threat or an admin initiates a logout, Okta sends a server-to-server request to ScribbleMaps to immediately revoke all active sessions for the affected user. This operates entirely outside the context of the user's browser, ensuring sessions are terminated even if the user is not actively using the application.
Note: Users must be provisioned from Okta (via SCIM or SSO) for the Universal Logout feature to work.
Requirements
- A ScribbleMaps Team workspace with SSO (SAML or OIDC) configured
- An Okta tenant
- An Okta user account with Admin privileges
Enable Universal Logout in Okta
- Log into the Okta Admin Console.
- Select Applications > Applications from the left navigation.
- Select the ScribbleMaps app integration.
- Go to the Authentication tab.
- In the Logout section, click Edit.
- Check the Okta system or admin initiates logout checkbox.
- Click Save.
How it works
When Universal Logout is triggered from Okta (for example, due to a detected security threat or an admin-initiated action):
- Okta sends a signed JWT (Security Event Token) to the ScribbleMaps Universal Logout endpoint.
- ScribbleMaps validates the JWT signature using Okta's JSON Web Key Set (JWKS).
- ScribbleMaps identifies the affected user by their email address.
- All active sessions for that user are immediately revoked across all platforms (desktop, mobile, and lite).
- The user is required to re-authenticate on their next access attempt.
Technical details
| Property | Value |
|---|---|
| Global token revocation endpoint | https://api.scribblemaps.com/sso/universal-logout |
| Authentication method | SIGNED_JWT |
| Subject format | |
| Supported SSO protocols | SAML 2.0, OIDC |
Troubleshooting
| Issue | Resolution |
|---|---|
| Universal Logout not triggering | Verify the user is provisioned from Okta and that Universal Logout is enabled in the Okta Admin Console. |
| User sessions not revoked | Confirm the user's email in Okta matches their email in ScribbleMaps. |
| 401/403 errors | Ensure SSO is properly configured and enabled for the team in ScribbleMaps. |
Comments
7 comments
why like that ?
Please sign in to leave a comment.