OKTA OpenID Signout

Hi all, thanks in advance if you can help me out. End goal is to allow users to log in and log out of a salesforce community using okta credentials (via an openid auth. provider).

When customers logout of the community, they should be logged out of okta as well.

I created an auth provider of type OpenID that connects to Okta as an authorization server.

• Salesforce - Configure OpenID Connect Settings for Single Logout Where Salesforce Is the Relying Party (https://help.salesforce.com/articleView?id=security_auth_slo_oidc_rp_configuring.htm&type=5)
  • This documentation suggests that all you need to do is configure the custom logout url to the /logout endpoint for okta, and then update the okta logout redirect url to the auth. provider generated single logout url
• Okta - Single Logout In Applications (https://help.okta.com/en/prod/Content/Topics/Apps/Apps_Single_Logout.htm)
  • This documentation suggests that it is necessary to  update the okta logout redirect url (as listed above by salesforce documentation) and that the relying party must make a get request in the format below
  • format:

GET https://{baseUrl}/logout?id_token_hint=${id_token}&post_logout_redirect_uri=${post_logout_redirect_uri}&state=${state}

Right now the logout takes them back to the Login screen where they can redirect back to okta and get right back in without entered credentials. So they're being logged out of SF, but not OKTA.

Questions:

1. Do we need to create a custom logout component in order to set the variables/parameters lsited in the okta documentation get request? Or is that handled by the salesforce auth provider?
2. Is it possible to configure slo for an auth. provider that is connected to a community?  Or is this a format that salesforce is not compatible with?
3. If you have configured slo for a community before and have any resources or relevent documentation, could you please share? I have had trouble finding community specific slo information.