Explain how logout works in Nextcloud

roles/cloud/README.md

@@ -68,3 +68,15 @@ from the *clamav-unofficial-sigs* datasets. If/when we'd like to use
 these for antispam purposes as well we might want to turn this into a
 separate standalone service.
 
+## SSO integration
+
+Nextcloud uses our single sign-on infrastructure by way of the
+*user_saml* application and libapache2-mod-sso. The user_saml app
+is configured to use the REDIRECT_REMOTE_USER environment variable
+from the request, which is set by mod_sso. Once the initial exchange
+is done, Nextcloud uses its own authenticated session.
+
+The logout workflow requires a patch to send the user to the
+centralized logout URL, and to handle the /sso_logout endpoint
+by logging out the user out of Nextcloud's session as well.
+