When you logout, Business Process Portal calls the session.invalidate() method. It calls back the session unbound listener, registered while logging in. Business Process Portal then takes the necessary steps to clean up the allocated resources. It is recommended that a similar approach should be taken while customizing the logout page. Your customized BPM Sign-on Logout page may perform various operations as per your requirements, but it must call the session.invalidate() method.