In environments where multiple OpenID Connect clients (each with end session endpoints defined) are enabled with the "Logout from identity provider" setting, users may be redirected to the incorrect identity provider after logging out. This occurs because:
If the last returned client name does not correspond to the account used for login, the user is redirected to the wrong identity provider, and the session is not properly terminated at the identity provider's end.
This issue is acknowledged in the redirectLogout() function with the following @todo note:
// @todo The fact that the user has a connected account doesn't necessarily
// mean that it was used for the login. This info should probably be kept
// in the session.
Users may be redirected to the incorrect identity provider, and the session may not be terminated at the identity provider's end.
Active
3.0
Code
Patch attached that tries to implement the proposed solution by adding the client name to the session and ensuring logout operations are performed only for the connected account used for login.
Updated patch available - please test and share your feedback.