What Happens When the Host App Logs Out First?

Consider an agent finishing campaign training inside the field app. The academy records completion, but the host session has expired. If reward delivery depends on that session, the agent could see success while the rewards system sees nothing.

One login does not create one clock

NIST’s federation guidance distinguishes independently managed application sessions, even when they share an identity provider. (pages.nist.gov) Embedded LMS session management therefore needs more than a successful login test. The integration must define which session authorizes each action and what happens when that authority ends.

Four windows expose the boundary

Host app session expiry is only one window. The academy might expire first while the host remains usable. A network drop might interrupt saving or hide an acknowledgement. An agent might return after both sessions expire. These cases need separate outcomes, not one generic instruction to log in again.

Saved progress and delivered outcomes are different states

Learning progress synchronization should distinguish work held on the device, records saved by the academy and outcomes accepted by the host. A robust design commits completion and a pending delivery record together before sending the event. Certificates should reference the durable completion record. Reward confirmation should wait for the agreed host acknowledgement.

OAuth supports service authorization through client credentials without a learner’s browser session. (rfc-editor.org) Where security policy permits, backend delivery should use that separate authority rather than depend on an open screen. Logout and revocation rules still need explicit treatment.

Reauthentication must preserve identity without transferring records

OpenID Connect session management treats a returned identity change as logout for the original user. (openid.net) Academy integration authentication should specify refresh conditions, visible reauthentication and the point where protected activity pauses. Retaining progress must not mean retaining access.

OpenID Connect uses issuer and subject together as the stable user identifier. (openid.net) The integration should map that identity to the correct agent account. Pending records must remain attached to their original learner if someone else signs in.

HTTP semantics caution against automatic retries of non-idempotent operations without safeguards. (rfc-editor.org) Each outcome should retain one event ID across retries. The receiver should record that ID and apply its effect atomically, so replay cannot issue another reward. Event IDs should identify occurrences, not serve as session credentials. Bounded retries need an escalation path for unresolved delivery.

Acceptance depends on interrupted states

An acceptance matrix should pair each condition with the learner message, persisted record and expected host effect.

• Host expires first — saved completion survives and delivery follows the agreed policy.
• Academy expires first — protected activity pauses without resetting saved progress.
• Network drops before saving — the interface does not claim server confirmation.
• Host commits but acknowledgement disappears — replay produces no second reward.
• Agent returns after expiry — identity is checked before restoring learner-specific state.

The launch contract owns the recovery path

For an App-Learning integration, the session-state contract should document timeout ownership, refresh limits, logout propagation, storage boundaries, event fields, acknowledgement meaning and retry retention. It also needs a named owner and reconciliation procedure for events that remain unresolved.

The goal is not to keep every session alive. It is to keep learner records correct when sessions end. An agent should not have to repeat valid training because delivery failed, and operations should not have to guess whether a completion became a certificate, sales permission or reward.