These endpoints are available on the engine.http.port and agent.http.port ports defined in <PA_HOME>/conf/run.properties.

/pa/oidc/logout

This endpoint clears the browser cookie containing the PingAccess Token. This endpoint enables end users to trigger the removal of their own PingAccess Cookie from the browser they are using. The user is redirected to the logged out page. You can modify the template for this page, located at <PA_INSTALL>/conf/template/general.loggedout.page.template.html.

Info:

This endpoint does not retain any server-side state to denote log off. Additionally, unless single-logout (SLO) is selected for the token provider, this endpoint clears the cookie only from the requested host/domain, and the cookie might still exist in requests bound for other hosts/domains.

Note:

If you selected the Use Single-Logout option when configuring the token provider, this endpoint also sends a logout request to the token provider, which completes a full SLO flow.

/pa/oidc/cb

This endpoint, along with the application virtual host, becomes the redirect URI for the token provider configuration on the client.

/pa/oidc/JWKS

This endpoint is used by the token provider's JSON web token (JWT) Token Processor for signature verification. This endpoint must be used in conjunction with the configuration of a JWT token processor instance in the token provider. For more information on configuring a JWT in PingFederate, see the PingFederate documentation.

/pa/oidc/logout.png

This endpoint is used by the token provider to initiate a logout from PingAccess in conjunction with SLO functionality, terminating the PingAccess tokens across domains.