Issue
Pega Constellation does not display a custom screen after logout.
Symptoms and Impact
Constellation logoff does not allow the loading of Pega's custom logoff screen from Web-Session-Return.
Steps to Reproduce
1. Design the application to load a custom logoff screen from the Web-Session-Return HTML.
2. Log in to the Constellation application using any Authentication service (SAML, OIDC, LDAP, Basic)
3. Log out from the Constellation application. The logoff screen will not be displayed.
Root Cause
Constellation applications use a different logout architecture compared to Traditional UI, relying on a platform logout API that returns an HTML response with a redirect URL.
This redirect behavior can conflict with client-side authentication mechanisms, leading to unintended re-authentication.
The issue arises due to the following architectural differences between Traditional UI and Constellation applications in Pega:
-
Constellation Logout Flow
-
Constellation uses the Pega platform’s logout API to log off users.
-
The logout response returns an HTML page containing a
<META http-equiv="refresh">tag. -
Constellation’s JavaScript parses this tag and redirects the browser to the specified URL.
-
Client Authentication Logic
-
Many client applications use custom SSO authentication mechanisms that automatically log users in when the login screen is loaded.
-
As a result, redirecting to the login screen after logout causes immediate re-authentication, taking users back to the portal instead of showing a logoff screen.
-
Design Gap
-
Traditional UI supports displaying a custom logoff screen
-
Constellation, by default, does not support this behavior. This leads to inconsistent logout experiences across traditional and constellation applications.
Solution
An enhancement request to make the Constellation Portal EndSession Redirect functionality configurable has been logged but has not yet been assigned to a specific release.
This Known Issue document will be updated with release details when the enhancement for this issue is available.
References
Configuring advanced application settings
Specifying preauthentication and postauthentication activities for a SAML SSO authentication service
OIDC session not terminated when logout