# SSO problems and doubts

**URL:** <https://forum.keycloak.org/t/sso-problems-and-doubts/31370>\
**Category:** Configuring the server\
**Created:** [May 14, 2026, 4:04pm UTC](https://forum.keycloak.org/t/sso-problems-and-doubts/31370 "2026-05-14T16:04:38Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![embesozzi](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/embesozzi/32/12390_2.png) [@embesozzi](https://forum.keycloak.org/u/embesozzi)\
**Post date:** [May 15, 2026, 3:59pm UTC](https://forum.keycloak.org/t/sso-problems-and-doubts/31370/3 "2026-05-15T15:59:17Z")

</div>

Keep things simple.  
Forget about iframes and implement standard federation with OIDC using the Authorization Code flow with PKCE.  
Then, for logout, there are several options depending on the user experience and the type of application you have.

- OIDC RP-Initiated Logout [1]
- OIDC Back-Channel Logout [2]

[1] [Final: OpenID Connect RP-Initiated Logout 1.0](https://openid.net/specs/openid-connect-rpinitiated-1_0.html)  
[2] [Final: OpenID Connect Back-Channel Logout 1.0](https://openid.net/specs/openid-connect-backchannel-1_0-final.html)

---

_[View the full topic](https://forum.keycloak.org/t/sso-problems-and-doubts/31370)._