Government of Sint Maarten — Digital Identity Platform

Relying party documentation

Logout & single sign-out

End the local application session and optionally sign the citizen out of the SXM Identity Broker session.

Register relying partyDeveloper sandboxRP portal

RP-initiated logout

  1. Clear your application session (cookie / server store).
  2. Optionally redirect to broker end-session with the broker-issued ID token from login.
Broker end-session (structure)
GET https://localhost:9443/oidc/logout
  ?id_token_hint={BROKER_ID_TOKEN}
  &post_logout_redirect_uri={URL_ENCODED_HOME}
  &client_id={YOUR_CLIENT_ID}

Register post_logout_redirect_uri on your OAuth application. Use the ID token from the broker, not an upstream eID token.

VariableDescription
WSO2_LOGOUT_URLBroker end-session — typically https://localhost:9443/oidc/logout
WSO2_POST_LOGOUT_REDIRECT_URIRegistered post-logout redirect (byte-match broker config)

Front-channel logout (optional)

Expose GET /auth/slo that clears the local session and returns minimal HTML (200 OK). Used when the platform or citizen portal triggers logout via hidden iframes across connected applications.

Citizen eID portal (informational)

Troubleshooting

SymptomLikely cause
Broker logout errorWrong id_token_hint, unregistered post-logout URI, or stale token
User still signed in at brokerEnd-session URL not called or wrong client_id
Mixed content on SLO iframesHTTPS broker cannot load HTTP RP URLs — align schemes in dev