title: Spring Boot OAuth2 Single Sign Off (Logout)
body: <p>I'm considering to use OAuth2 for my application. The architecture I'm trying to implement is as follows:</p>
  
  <ul>
  <li>I will have my own (and only this) Authorization Server</li>
  <li>Some Resource Apps validating access to their resources using the Authorization Server</li>
  <li>Some client apps (web, mobile) which will redirect the user to the Authorization Server for authentication and on success will consume the api's on the Resource Apps.</li>
  </ul>
  
  <p>So far I have managed to implement this interaction between 3 basic apps (1 auth server, 1 resource server and 1 client). The thing I don't get working is the logout functionality. I have read of the <a href="https://spring.io/blog/2015/02/03/sso-with-oauth2-angular-js-and-spring-security-part-v#the-logout-experience" rel="noreferrer" title="notoriously tricky problem">"notoriously tricky problem"</a> that Dave Syer describes in his tutorial, but in this case I really need the user to re-login after loging out. I have tried giving few seconds to the access token and the refresh token, but instead of being prompted to login again when the expiration arrives, I'm getting a NPE on the client app. I have also tried the solutions proposed in this <a href="https://stackoverflow.com/questions/21987589/spring-security-how-to-log-out-user-revoke-oauth2-token" title="post">post</a> to remove the token from the token store, but it doesn't work. The single sign off is for me the desirable behaviour for this implementation. How can I achieve this using Spring Boot Oauth2. If it is not possible for some reason, which alternatives I could use to implement a centralized security using Spring Boot?</p>
  
  <p>Thanks in advance.</p>