MCM-39 — Clean Logout
Logging out ends both the gateway session and the Keycloak SSO session, so shared machines don't retain access.
MCM-39 — Clean Logout
← Back to Internal Docs Single Sign-On overview
As an Engineering Staff member,
I want a logout action that ends my session completely,
so that a shared or public machine doesn't retain my access after I'm done.
Acceptance Criteria
- A logout action is available from mcm-docs and ends the gateway session.
- Logging out also ends the Keycloak SSO session, not just the local gateway session — a shared identity provider session doesn't silently keep the user signed in.
- After logout, visiting mcm-docs again requires logging in from scratch.
Technical Design
Logout ends both layers of session at once: the gateway's own session and the underlying Keycloak SSO session, so a single action removes access at both the gateway and the identity provider — not just a local cookie clear that leaves the identity provider still considering the user logged in.
UI / Frontend Changes
- A visible logout action on mcm-docs itself.
- After logout, the next visit to mcm-docs behaves exactly like a first-ever visit — full login required.
MCM-38 — Unauthorized Access Fails Closed
Unauthenticated or invalid requests to mcm-docs always redirect or fail clearly, never leak content or show a broken page.
MCM-42 — Pre-Provisioning Cost Estimation
Overview and shared context for estimating cloud cost before infrastructure is provisioned across AWS and Azure.