Signing out from the service does not force re-logging in from the upstream IdP

[hughns]

A current experience:

Sign.Out.on.consent.behaviour.mov

[hughns]

This is caused by the upstream IdP remaining signed in (rather than the sign out being propagated to it).

The fix is that when MAS re-authenticates with the upstream IdP that it send prompt= select_account so that the upstream IdP prompts the user appropriate.

Also, change the button label to "Switch account"

[pmaier1]

Please also

• remove any references to Matrix here (e.g., "wants to access your account")
• remove that callback link (first line) or make it more user friendly

[sandhose]

Boo, Keycloak doesn't support prompt=select_account, only prompt=login, and the UI for it is quite bad :(

You have to click on the weird blue arrow to log out and change account.

I'll try to evaluate how much of a pain it would be to properly do RP-initiated logout instead.

[pmaier1]

Alternative: Remove "sign out" button and improve it for a further release.

[wrjlewis]

mas.logout.mov

This is still the case today ^

[matrixbot]

For your information, this issue has been copied over to the Element fork of matrix-authentication-service: element-hq/matrix-authentication-service#1569