diff --git a/client/client.go b/client/client.go
index 0a56836253c..03f63972a01 100644
--- a/client/client.go
+++ b/client/client.go
@@ -294,6 +294,11 @@ type Client struct {
 	Lifespans
 }
 
+type LoginSessionClient struct {
+	Client
+	LoginSessionID string `json:"login_session_id,omitempty" db:"login_session_id"`
+}
+
 // OAuth 2.0 Client Token Lifespans
 //
 // Lifespans of different token types issued for this OAuth 2.0 Client.
diff --git a/consent/handler.go b/consent/handler.go
index 99078be690d..109cc5b4b94 100644
--- a/consent/handler.go
+++ b/consent/handler.go
@@ -84,12 +84,22 @@ type revokeOAuth2ConsentSessions struct {
 	// in: query
 	Client string `json:"client"`
 
+	// If set, deletes only those consent sessions by the Subject that have been granted to the specified session id. Can be combined with client or all parameter.
+	//
+	// in: query
+	LoginSessionId string `json:"login_session_id"`
+
 	// Revoke All Consent Sessions
 	//
 	// If set to `true` deletes all consent sessions by the Subject that have been granted.
 	//
 	// in: query
 	All bool `json:"all"`
+
+	// If set to `?trigger_back_channel_logout=true`, performs back channel logout for matching clients
+	//
+	// in: query
+	TriggerBackChannelLogout bool `json:"trigger_back_channel_logout"`
 }
 
 // swagger:route DELETE /admin/oauth2/auth/sessions/consent oAuth2 revokeOAuth2ConsentSessions
@@ -113,7 +123,10 @@ type revokeOAuth2ConsentSessions struct {
 func (h *Handler) revokeOAuth2ConsentSessions(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
 	subject := r.URL.Query().Get("subject")
 	client := r.URL.Query().Get("client")
+	loginSessionId := r.URL.Query().Get("login_session_id")
+	triggerBackChannelLogout := r.URL.Query().Get("trigger_back_channel_logout")
 	allClients := r.URL.Query().Get("all") == "true"
+
 	if subject == "" {
 		h.r.Writer().WriteError(w, r, errorsx.WithStack(fosite.ErrInvalidRequest.WithHint(`Query parameter 'subject' is not defined but should have been.`)))
 		return
@@ -121,14 +134,41 @@ func (h *Handler) revokeOAuth2ConsentSessions(w http.ResponseWriter, r *http.Req
 
 	switch {
 	case len(client) > 0:
-		if err := h.r.ConsentManager().RevokeSubjectClientConsentSession(r.Context(), subject, client); err != nil && !errors.Is(err, x.ErrNotFound) {
-			h.r.Writer().WriteError(w, r, err)
-			return
+		if len(loginSessionId) > 0 {
+			if triggerBackChannelLogout == "true" {
+				h.r.ConsentStrategy().ExecuteBackChannelLogoutByClientSession(r.Context(), r, subject, client, loginSessionId)
+			}
+			if err := h.r.ConsentManager().RevokeSubjectClientLoginSessionConsentSession(r.Context(), subject, client, loginSessionId); err != nil && !errors.Is(err, x.ErrNotFound) {
+				h.r.Writer().WriteError(w, r, err)
+				return
+			}
+		} else {
+			if triggerBackChannelLogout == "true" {
+				h.r.ConsentStrategy().ExecuteBackChannelLogoutByClient(r.Context(), r, subject, client)
+			}
+			if err := h.r.ConsentManager().RevokeSubjectClientConsentSession(r.Context(), subject, client); err != nil && !errors.Is(err, x.ErrNotFound) {
+				h.r.Writer().WriteError(w, r, err)
+				return
+			}
 		}
+
 	case allClients:
-		if err := h.r.ConsentManager().RevokeSubjectConsentSession(r.Context(), subject); err != nil && !errors.Is(err, x.ErrNotFound) {
-			h.r.Writer().WriteError(w, r, err)
-			return
+		if len(loginSessionId) > 0 {
+			if triggerBackChannelLogout == "true" {
+				h.r.ConsentStrategy().ExecuteBackChannelLogoutBySession(r.Context(), r, subject, loginSessionId)
+			}
+			if err := h.r.ConsentManager().RevokeLoginSessionConsentSession(r.Context(), loginSessionId); err != nil && !errors.Is(err, x.ErrNotFound) {
+				h.r.Writer().WriteError(w, r, err)
+				return
+			}
+		} else {
+			if triggerBackChannelLogout == "true" {
+				h.r.ConsentStrategy().ExecuteBackChannelLogoutBySubject(r.Context(), r, subject)
+			}
+			if err := h.r.ConsentManager().RevokeSubjectConsentSession(r.Context(), subject); err != nil && !errors.Is(err, x.ErrNotFound) {
+				h.r.Writer().WriteError(w, r, err)
+				return
+			}
 		}
 	default:
 		h.r.Writer().WriteError(w, r, errorsx.WithStack(fosite.ErrInvalidRequest.WithHint(`Query parameter both 'client' and 'all' is not defined but one of them should have been.`)))
diff --git a/consent/handler_test.go b/consent/handler_test.go
index ca4e10fa596..b14a3ba2852 100644
--- a/consent/handler_test.go
+++ b/consent/handler_test.go
@@ -10,9 +10,16 @@ import (
 	"fmt"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
+	"sync"
 	"testing"
 	"time"
 
+	"github.com/stretchr/testify/assert"
+	"github.com/tidwall/gjson"
+
+	"github.com/ory/hydra/driver"
+
 	"github.com/ory/x/pointerx"
 
 	"github.com/ory/hydra/consent"
@@ -277,3 +284,270 @@ func TestGetLoginRequestWithDuplicateAccept(t *testing.T) {
 		require.Contains(t, result2.RedirectTo, "login_verifier")
 	})
 }
+
+func TestRevokeConsentSession(t *testing.T) {
+	newWg := func(add int) *sync.WaitGroup {
+		var wg sync.WaitGroup
+		wg.Add(add)
+		return &wg
+	}
+
+	t.Run("case=subject=subject-1,client=client-1,session=session-1,trigger_back_channel_logout=true", func(t *testing.T) {
+		conf := internal.NewConfigurationWithDefaults()
+		reg := internal.NewRegistryMemory(t, conf, &contextx.Default{})
+		backChannelWG := newWg(1)
+		cl := createClientWithBackChannelEndpoint(t, reg, "client-1", []string{"login-session-1"}, backChannelWG)
+		performLoginFlow(t, reg, "1", cl)
+		performLoginFlow(t, reg, "2", cl)
+		performDeleteConsentSession(t, reg, "client-1", "login-session-1", true)
+		c1, err := reg.ConsentManager().GetConsentRequest(context.Background(), "consent-challenge-1")
+		require.Error(t, x.ErrNotFound, err)
+		require.Nil(t, c1)
+		c2, err := reg.ConsentManager().GetConsentRequest(context.Background(), "consent-challenge-2")
+		require.NoError(t, err)
+		require.NotNil(t, c2)
+		backChannelWG.Wait()
+	})
+
+	t.Run("case=subject=subject-1,client=client-1,session=session-1,trigger_back_channel_logout=false", func(t *testing.T) {
+		conf := internal.NewConfigurationWithDefaults()
+		reg := internal.NewRegistryMemory(t, conf, &contextx.Default{})
+		backChannelWG := newWg(0)
+		cl := createClientWithBackChannelEndpoint(t, reg, "client-1", []string{}, backChannelWG)
+		performLoginFlow(t, reg, "1", cl)
+		performLoginFlow(t, reg, "2", cl)
+		performDeleteConsentSession(t, reg, "client-1", "login-session-1", false)
+		c1, err := reg.ConsentManager().GetConsentRequest(context.Background(), "consent-challenge-1")
+		require.Error(t, x.ErrNotFound, err)
+		require.Nil(t, c1)
+		c2, err := reg.ConsentManager().GetConsentRequest(context.Background(), "consent-challenge-2")
+		require.NoError(t, err)
+		require.NotNil(t, c2)
+		backChannelWG.Wait()
+	})
+
+	t.Run("case=subject=subject-1,client=client-1,trigger_back_channel_logout=true", func(t *testing.T) {
+		conf := internal.NewConfigurationWithDefaults()
+		reg := internal.NewRegistryMemory(t, conf, &contextx.Default{})
+		backChannelWG := newWg(2)
+		cl := createClientWithBackChannelEndpoint(t, reg, "client-1", []string{"login-session-1", "login-session-2"}, backChannelWG)
+		performLoginFlow(t, reg, "1", cl)
+		performLoginFlow(t, reg, "2", cl)
+
+		performDeleteConsentSession(t, reg, "client-1", nil, true)
+
+		c1, err := reg.ConsentManager().GetConsentRequest(context.Background(), "consent-challenge-1")
+		require.Error(t, x.ErrNotFound, err)
+		require.Nil(t, c1)
+		c2, err := reg.ConsentManager().GetConsentRequest(context.Background(), "consent-challenge-2")
+		require.Error(t, x.ErrNotFound, err)
+		require.Nil(t, c2)
+		backChannelWG.Wait()
+	})
+
+	t.Run("case=subject=subject-1,client=client-1,trigger_back_channel_logout=false", func(t *testing.T) {
+		conf := internal.NewConfigurationWithDefaults()
+		reg := internal.NewRegistryMemory(t, conf, &contextx.Default{})
+		backChannelWG := newWg(0)
+		cl := createClientWithBackChannelEndpoint(t, reg, "client-1", []string{}, backChannelWG)
+		performLoginFlow(t, reg, "1", cl)
+		performLoginFlow(t, reg, "2", cl)
+
+		performDeleteConsentSession(t, reg, "client-1", nil, false)
+
+		c1, err := reg.ConsentManager().GetConsentRequest(context.Background(), "consent-challenge-1")
+		require.Error(t, x.ErrNotFound, err)
+		require.Nil(t, c1)
+		c2, err := reg.ConsentManager().GetConsentRequest(context.Background(), "consent-challenge-2")
+		require.Error(t, x.ErrNotFound, err)
+		require.Nil(t, c2)
+		backChannelWG.Wait()
+	})
+
+	t.Run("case=subject=subject-1,all=true,session=session-1,trigger_back_channel_logout=true", func(t *testing.T) {
+		conf := internal.NewConfigurationWithDefaults()
+		reg := internal.NewRegistryMemory(t, conf, &contextx.Default{})
+		backChannelWG := newWg(1)
+		cl1 := createClientWithBackChannelEndpoint(t, reg, "client-1", []string{"login-session-1"}, backChannelWG)
+		cl2 := createClientWithBackChannelEndpoint(t, reg, "client-2", []string{}, backChannelWG)
+		performLoginFlow(t, reg, "1", cl1)
+		performLoginFlow(t, reg, "2", cl2)
+
+		performDeleteConsentSession(t, reg, nil, "login-session-1", true)
+
+		c1, err := reg.ConsentManager().GetConsentRequest(context.Background(), "consent-challenge-1")
+		require.Error(t, x.ErrNotFound, err)
+		require.Nil(t, c1)
+		c2, err := reg.ConsentManager().GetConsentRequest(context.Background(), "consent-challenge-2")
+		require.NoError(t, err)
+		require.NotNil(t, c2)
+		backChannelWG.Wait()
+	})
+
+	t.Run("case=subject=subject-1,all=true,session=session-1,trigger_back_channel_logout=false", func(t *testing.T) {
+		conf := internal.NewConfigurationWithDefaults()
+		reg := internal.NewRegistryMemory(t, conf, &contextx.Default{})
+		backChannelWG := newWg(0)
+		cl1 := createClientWithBackChannelEndpoint(t, reg, "client-1", []string{}, backChannelWG)
+		cl2 := createClientWithBackChannelEndpoint(t, reg, "client-2", []string{}, backChannelWG)
+		performLoginFlow(t, reg, "1", cl1)
+		performLoginFlow(t, reg, "2", cl2)
+
+		performDeleteConsentSession(t, reg, nil, "login-session-1", false)
+
+		c1, err := reg.ConsentManager().GetConsentRequest(context.Background(), "consent-challenge-1")
+		require.Error(t, x.ErrNotFound, err)
+		require.Nil(t, c1)
+		c2, err := reg.ConsentManager().GetConsentRequest(context.Background(), "consent-challenge-2")
+		require.NoError(t, err)
+		require.NotNil(t, c2)
+		backChannelWG.Wait()
+	})
+
+	t.Run("case=subject=subject-1,all=true,trigger_back_channel_logout=true", func(t *testing.T) {
+		conf := internal.NewConfigurationWithDefaults()
+		reg := internal.NewRegistryMemory(t, conf, &contextx.Default{})
+		backChannelWG := newWg(2)
+		cl1 := createClientWithBackChannelEndpoint(t, reg, "client-1", []string{"login-session-1"}, backChannelWG)
+		cl2 := createClientWithBackChannelEndpoint(t, reg, "client-2", []string{"login-session-2"}, backChannelWG)
+		performLoginFlow(t, reg, "1", cl1)
+		performLoginFlow(t, reg, "2", cl2)
+
+		performDeleteConsentSession(t, reg, nil, nil, true)
+
+		c1, err := reg.ConsentManager().GetConsentRequest(context.Background(), "consent-challenge-1")
+		require.Error(t, x.ErrNotFound, err)
+		require.Nil(t, c1)
+		c2, err := reg.ConsentManager().GetConsentRequest(context.Background(), "consent-challenge-2")
+		require.Error(t, x.ErrNotFound, err)
+		require.Nil(t, c2)
+		backChannelWG.Wait()
+	})
+
+	t.Run("case=subject=subject-1,all=true,trigger_back_channel_logout=false", func(t *testing.T) {
+		conf := internal.NewConfigurationWithDefaults()
+		reg := internal.NewRegistryMemory(t, conf, &contextx.Default{})
+		backChannelWG := newWg(0)
+		cl1 := createClientWithBackChannelEndpoint(t, reg, "client-1", []string{}, backChannelWG)
+		cl2 := createClientWithBackChannelEndpoint(t, reg, "client-2", []string{}, backChannelWG)
+		performLoginFlow(t, reg, "1", cl1)
+		performLoginFlow(t, reg, "2", cl2)
+
+		performDeleteConsentSession(t, reg, nil, nil, false)
+
+		c1, err := reg.ConsentManager().GetConsentRequest(context.Background(), "consent-challenge-1")
+		require.Error(t, x.ErrNotFound, err)
+		require.Nil(t, c1)
+		c2, err := reg.ConsentManager().GetConsentRequest(context.Background(), "consent-challenge-2")
+		require.Error(t, x.ErrNotFound, err)
+		require.Nil(t, c2)
+		backChannelWG.Wait()
+	})
+}
+
+func performDeleteConsentSession(t *testing.T, reg driver.Registry, client, loginSessionId interface{}, triggerBackChannelLogout bool) {
+	conf := internal.NewConfigurationWithDefaults()
+
+	h := NewHandler(reg, conf)
+	r := x.NewRouterAdmin(conf.AdminURL)
+	h.SetRoutes(r)
+	ts := httptest.NewServer(r)
+	defer ts.Close()
+	c := &http.Client{}
+
+	u, _ := url.Parse(ts.URL + "/admin" + SessionsPath + "/consent")
+	q := u.Query()
+	q.Set("subject", "subject-1")
+	if client != nil && len(client.(string)) != 0 {
+		q.Set("client", client.(string))
+	} else {
+		q.Set("all", "true")
+	}
+	if loginSessionId != nil && len(loginSessionId.(string)) != 0 {
+		q.Set("login_session_id", loginSessionId.(string))
+	}
+	if triggerBackChannelLogout {
+		q.Set("trigger_back_channel_logout", "true")
+	}
+	u.RawQuery = q.Encode()
+	req, err := http.NewRequest(http.MethodDelete, u.String(), nil)
+
+	require.NoError(t, err)
+	_, err = c.Do(req)
+	require.NoError(t, err)
+}
+
+func performLoginFlow(t *testing.T, reg driver.Registry, flowId string, cl *client.Client) {
+	subject := "subject-1"
+	loginSessionId := "login-session-" + flowId
+	loginChallenge := "login-challenge-" + flowId
+	consentChallenge := "consent-challenge-" + flowId
+	requestURL := "http://192.0.2.1"
+
+	ls := &LoginSession{
+		ID:      loginSessionId,
+		Subject: subject,
+	}
+	lr := &LoginRequest{
+		ID:         loginChallenge,
+		Subject:    subject,
+		Client:     cl,
+		RequestURL: requestURL,
+		Verifier:   "login-verifier-" + flowId,
+		SessionID:  sqlxx.NullString(loginSessionId),
+	}
+	cr := &OAuth2ConsentRequest{
+		Client:         cl,
+		ID:             consentChallenge,
+		Verifier:       consentChallenge,
+		CSRF:           consentChallenge,
+		Subject:        subject,
+		LoginChallenge: sqlxx.NullString(loginChallenge),
+		LoginSessionID: sqlxx.NullString(loginSessionId),
+	}
+	hcr := &AcceptOAuth2ConsentRequest{
+		ConsentRequest: cr,
+		ID:             consentChallenge,
+		WasHandled:     true,
+		HandledAt:      sqlxx.NullTime(time.Now().UTC()),
+	}
+
+	require.NoError(t, reg.ConsentManager().CreateLoginSession(context.Background(), ls))
+	require.NoError(t, reg.ConsentManager().CreateLoginRequest(context.Background(), lr))
+	require.NoError(t, reg.ConsentManager().CreateConsentRequest(context.Background(), cr))
+	_, err := reg.ConsentManager().HandleConsentRequest(context.Background(), hcr)
+	require.NoError(t, err)
+}
+
+func createClientWithBackChannelEndpoint(t *testing.T, reg driver.Registry, clientId string, expectedBackChannelLogoutFlowIds []string, wg *sync.WaitGroup) *client.Client {
+	return func(t *testing.T, key string, wg *sync.WaitGroup, cb func(t *testing.T, logoutToken gjson.Result)) *client.Client {
+		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			defer wg.Done()
+			require.NoError(t, r.ParseForm())
+			lt := r.PostFormValue("logout_token")
+			assert.NotEmpty(t, lt)
+			token, err := reg.OpenIDJWTStrategy().Decode(r.Context(), lt)
+			require.NoError(t, err)
+			var b bytes.Buffer
+			require.NoError(t, json.NewEncoder(&b).Encode(token.Claims))
+			cb(t, gjson.Parse(b.String()))
+		}))
+		t.Cleanup(server.Close)
+		c := &client.Client{
+			LegacyClientID:       clientId,
+			BackChannelLogoutURI: server.URL,
+		}
+		err := reg.ClientManager().CreateClient(context.Background(), c)
+		require.NoError(t, err)
+		return c
+	}(t, clientId, wg, func(t *testing.T, logoutToken gjson.Result) {
+		sid := logoutToken.Get("sid").String()
+		assert.Contains(t, expectedBackChannelLogoutFlowIds, sid)
+		for i, v := range expectedBackChannelLogoutFlowIds {
+			if v == sid {
+				expectedBackChannelLogoutFlowIds = append(expectedBackChannelLogoutFlowIds[:i], expectedBackChannelLogoutFlowIds[i+1:]...)
+				break
+			}
+		}
+	})
+}
diff --git a/consent/manager.go b/consent/manager.go
index bc84ddf91c9..b9e81f3ea00 100644
--- a/consent/manager.go
+++ b/consent/manager.go
@@ -28,7 +28,9 @@ type Manager interface {
 	GetConsentRequest(ctx context.Context, challenge string) (*OAuth2ConsentRequest, error)
 	HandleConsentRequest(ctx context.Context, r *AcceptOAuth2ConsentRequest) (*OAuth2ConsentRequest, error)
 	RevokeSubjectConsentSession(ctx context.Context, user string) error
+	RevokeLoginSessionConsentSession(ctx context.Context, loginSessionId string) error
 	RevokeSubjectClientConsentSession(ctx context.Context, user, client string) error
+	RevokeSubjectClientLoginSessionConsentSession(ctx context.Context, user, client, loginSessionId string) error
 
 	VerifyAndInvalidateConsentRequest(ctx context.Context, verifier string) (*AcceptOAuth2ConsentRequest, error)
 	FindGrantedAndRememberedConsentRequests(ctx context.Context, client, user string) ([]AcceptOAuth2ConsentRequest, error)
@@ -51,8 +53,9 @@ type Manager interface {
 	CreateForcedObfuscatedLoginSession(ctx context.Context, session *ForcedObfuscatedLoginSession) error
 	GetForcedObfuscatedLoginSession(ctx context.Context, client, obfuscated string) (*ForcedObfuscatedLoginSession, error)
 
-	ListUserAuthenticatedClientsWithFrontChannelLogout(ctx context.Context, subject, sid string) ([]client.Client, error)
-	ListUserAuthenticatedClientsWithBackChannelLogout(ctx context.Context, subject, sid string) ([]client.Client, error)
+	ListUserSessionAuthenticatedClientsWithFrontChannelLogout(ctx context.Context, subject, sid string) ([]client.LoginSessionClient, error)
+	ListUserSessionAuthenticatedClientsWithBackChannelLogout(ctx context.Context, subject, sid string) ([]client.LoginSessionClient, error)
+	ListUserAuthenticatedClientsWithBackChannelLogout(ctx context.Context, subject string) ([]client.LoginSessionClient, error)
 
 	CreateLogoutRequest(ctx context.Context, request *LogoutRequest) error
 	GetLogoutRequest(ctx context.Context, challenge string) (*LogoutRequest, error)
diff --git a/consent/manager_mock_test.go b/consent/manager_mock_test.go
new file mode 100644
index 00000000000..7088bbce2d5
--- /dev/null
+++ b/consent/manager_mock_test.go
@@ -0,0 +1,765 @@
+// Copyright © 2022 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by MockGen. DO NOT EDIT.
+// Source: consent/manager.go
+// Package mock_consent is a generated GoMock package.
+package consent_test
+
+import (
+	context "context"
+	reflect "reflect"
+	time "time"
+
+	"github.com/gobuffalo/pop/v6"
+	"gopkg.in/square/go-jose.v2"
+
+	"github.com/ory/fosite"
+	"github.com/ory/hydra/consent"
+	"github.com/ory/hydra/oauth2/trust"
+	"github.com/ory/x/popx"
+
+	gomock "github.com/golang/mock/gomock"
+
+	client "github.com/ory/hydra/client"
+)
+
+// MockManager is a mock of Manager interface.
+type MockManager struct {
+	ctrl     *gomock.Controller
+	recorder *MockManagerMockRecorder
+}
+
+// MockManagerMockRecorder is the mock recorder for MockManager.
+type MockManagerMockRecorder struct {
+	mock *MockManager
+}
+
+// NewMockManager creates a new mock instance.
+func NewMockManager(ctrl *gomock.Controller) *MockManager {
+	mock := &MockManager{ctrl: ctrl}
+	mock.recorder = &MockManagerMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockManager) EXPECT() *MockManagerMockRecorder {
+	return m.recorder
+}
+
+// AcceptLogoutRequest mocks base method.
+func (m *MockManager) AcceptLogoutRequest(ctx context.Context, challenge string) (*consent.LogoutRequest, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "AcceptLogoutRequest", ctx, challenge)
+	ret0, _ := ret[0].(*consent.LogoutRequest)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// AcceptLogoutRequest indicates an expected call of AcceptLogoutRequest.
+func (mr *MockManagerMockRecorder) AcceptLogoutRequest(ctx, challenge interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AcceptLogoutRequest", reflect.TypeOf((*MockManager)(nil).AcceptLogoutRequest), ctx, challenge)
+}
+
+// ConfirmLoginSession mocks base method.
+func (m *MockManager) ConfirmLoginSession(ctx context.Context, id string, authTime time.Time, subject string, remember bool) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ConfirmLoginSession", ctx, id, authTime, subject, remember)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// ConfirmLoginSession indicates an expected call of ConfirmLoginSession.
+func (mr *MockManagerMockRecorder) ConfirmLoginSession(ctx, id, authTime, subject, remember interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ConfirmLoginSession", reflect.TypeOf((*MockManager)(nil).ConfirmLoginSession), ctx, id, authTime, subject, remember)
+}
+
+// CountSubjectsGrantedConsentRequests mocks base method.
+func (m *MockManager) CountSubjectsGrantedConsentRequests(ctx context.Context, user string) (int, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CountSubjectsGrantedConsentRequests", ctx, user)
+	ret0, _ := ret[0].(int)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// CountSubjectsGrantedConsentRequests indicates an expected call of CountSubjectsGrantedConsentRequests.
+func (mr *MockManagerMockRecorder) CountSubjectsGrantedConsentRequests(ctx, user interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CountSubjectsGrantedConsentRequests", reflect.TypeOf((*MockManager)(nil).CountSubjectsGrantedConsentRequests), ctx, user)
+}
+
+// CreateConsentRequest mocks base method.
+func (m *MockManager) CreateConsentRequest(ctx context.Context, req *consent.OAuth2ConsentRequest) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CreateConsentRequest", ctx, req)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// CreateConsentRequest indicates an expected call of CreateConsentRequest.
+func (mr *MockManagerMockRecorder) CreateConsentRequest(ctx, req interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateConsentRequest", reflect.TypeOf((*MockManager)(nil).CreateConsentRequest), ctx, req)
+}
+
+// CreateForcedObfuscatedLoginSession mocks base method.
+func (m *MockManager) CreateForcedObfuscatedLoginSession(ctx context.Context, session *consent.ForcedObfuscatedLoginSession) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CreateForcedObfuscatedLoginSession", ctx, session)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// CreateForcedObfuscatedLoginSession indicates an expected call of CreateForcedObfuscatedLoginSession.
+func (mr *MockManagerMockRecorder) CreateForcedObfuscatedLoginSession(ctx, session interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateForcedObfuscatedLoginSession", reflect.TypeOf((*MockManager)(nil).CreateForcedObfuscatedLoginSession), ctx, session)
+}
+
+// CreateLoginRequest mocks base method.
+func (m *MockManager) CreateLoginRequest(ctx context.Context, req *consent.LoginRequest) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CreateLoginRequest", ctx, req)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// CreateLoginRequest indicates an expected call of CreateLoginRequest.
+func (mr *MockManagerMockRecorder) CreateLoginRequest(ctx, req interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateLoginRequest", reflect.TypeOf((*MockManager)(nil).CreateLoginRequest), ctx, req)
+}
+
+// CreateLoginSession mocks base method.
+func (m *MockManager) CreateLoginSession(ctx context.Context, session *consent.LoginSession) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CreateLoginSession", ctx, session)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// CreateLoginSession indicates an expected call of CreateLoginSession.
+func (mr *MockManagerMockRecorder) CreateLoginSession(ctx, session interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateLoginSession", reflect.TypeOf((*MockManager)(nil).CreateLoginSession), ctx, session)
+}
+
+// CreateLogoutRequest mocks base method.
+func (m *MockManager) CreateLogoutRequest(ctx context.Context, request *consent.LogoutRequest) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CreateLogoutRequest", ctx, request)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// CreateLogoutRequest indicates an expected call of CreateLogoutRequest.
+func (mr *MockManagerMockRecorder) CreateLogoutRequest(ctx, request interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateLogoutRequest", reflect.TypeOf((*MockManager)(nil).CreateLogoutRequest), ctx, request)
+}
+
+// DeleteLoginSession mocks base method.
+func (m *MockManager) DeleteLoginSession(ctx context.Context, id string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteLoginSession", ctx, id)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// DeleteLoginSession indicates an expected call of DeleteLoginSession.
+func (mr *MockManagerMockRecorder) DeleteLoginSession(ctx, id interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteLoginSession", reflect.TypeOf((*MockManager)(nil).DeleteLoginSession), ctx, id)
+}
+
+// FindGrantedAndRememberedConsentRequests mocks base method.
+func (m *MockManager) FindGrantedAndRememberedConsentRequests(ctx context.Context, client, user string) ([]consent.AcceptOAuth2ConsentRequest, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "FindGrantedAndRememberedConsentRequests", ctx, client, user)
+	ret0, _ := ret[0].([]consent.AcceptOAuth2ConsentRequest)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// FindGrantedAndRememberedConsentRequests indicates an expected call of FindGrantedAndRememberedConsentRequests.
+func (mr *MockManagerMockRecorder) FindGrantedAndRememberedConsentRequests(ctx, client, user interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "FindGrantedAndRememberedConsentRequests", reflect.TypeOf((*MockManager)(nil).FindGrantedAndRememberedConsentRequests), ctx, client, user)
+}
+
+// FindSubjectsGrantedConsentRequests mocks base method.
+func (m *MockManager) FindSubjectsGrantedConsentRequests(ctx context.Context, user string, limit, offset int) ([]consent.AcceptOAuth2ConsentRequest, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "FindSubjectsGrantedConsentRequests", ctx, user, limit, offset)
+	ret0, _ := ret[0].([]consent.AcceptOAuth2ConsentRequest)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// FindSubjectsGrantedConsentRequests indicates an expected call of FindSubjectsGrantedConsentRequests.
+func (mr *MockManagerMockRecorder) FindSubjectsGrantedConsentRequests(ctx, user, limit, offset interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "FindSubjectsGrantedConsentRequests", reflect.TypeOf((*MockManager)(nil).FindSubjectsGrantedConsentRequests), ctx, user, limit, offset)
+}
+
+// GetConsentRequest mocks base method.
+func (m *MockManager) GetConsentRequest(ctx context.Context, challenge string) (*consent.OAuth2ConsentRequest, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetConsentRequest", ctx, challenge)
+	ret0, _ := ret[0].(*consent.OAuth2ConsentRequest)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetConsentRequest indicates an expected call of GetConsentRequest.
+func (mr *MockManagerMockRecorder) GetConsentRequest(ctx, challenge interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetConsentRequest", reflect.TypeOf((*MockManager)(nil).GetConsentRequest), ctx, challenge)
+}
+
+// GetForcedObfuscatedLoginSession mocks base method.
+func (m *MockManager) GetForcedObfuscatedLoginSession(ctx context.Context, client, obfuscated string) (*consent.ForcedObfuscatedLoginSession, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetForcedObfuscatedLoginSession", ctx, client, obfuscated)
+	ret0, _ := ret[0].(*consent.ForcedObfuscatedLoginSession)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetForcedObfuscatedLoginSession indicates an expected call of GetForcedObfuscatedLoginSession.
+func (mr *MockManagerMockRecorder) GetForcedObfuscatedLoginSession(ctx, client, obfuscated interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetForcedObfuscatedLoginSession", reflect.TypeOf((*MockManager)(nil).GetForcedObfuscatedLoginSession), ctx, client, obfuscated)
+}
+
+// GetLoginRequest mocks base method.
+func (m *MockManager) GetLoginRequest(ctx context.Context, challenge string) (*consent.LoginRequest, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetLoginRequest", ctx, challenge)
+	ret0, _ := ret[0].(*consent.LoginRequest)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetLoginRequest indicates an expected call of GetLoginRequest.
+func (mr *MockManagerMockRecorder) GetLoginRequest(ctx, challenge interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetLoginRequest", reflect.TypeOf((*MockManager)(nil).GetLoginRequest), ctx, challenge)
+}
+
+// GetLogoutRequest mocks base method.
+func (m *MockManager) GetLogoutRequest(ctx context.Context, challenge string) (*consent.LogoutRequest, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetLogoutRequest", ctx, challenge)
+	ret0, _ := ret[0].(*consent.LogoutRequest)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetLogoutRequest indicates an expected call of GetLogoutRequest.
+func (mr *MockManagerMockRecorder) GetLogoutRequest(ctx, challenge interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetLogoutRequest", reflect.TypeOf((*MockManager)(nil).GetLogoutRequest), ctx, challenge)
+}
+
+// GetRememberedLoginSession mocks base method.
+func (m *MockManager) GetRememberedLoginSession(ctx context.Context, id string) (*consent.LoginSession, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetRememberedLoginSession", ctx, id)
+	ret0, _ := ret[0].(*consent.LoginSession)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetRememberedLoginSession indicates an expected call of GetRememberedLoginSession.
+func (mr *MockManagerMockRecorder) GetRememberedLoginSession(ctx, id interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetRememberedLoginSession", reflect.TypeOf((*MockManager)(nil).GetRememberedLoginSession), ctx, id)
+}
+
+// HandleConsentRequest mocks base method.
+func (m *MockManager) HandleConsentRequest(ctx context.Context, challenge string, r *consent.AcceptOAuth2ConsentRequest) (*consent.OAuth2ConsentRequest, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "HandleConsentRequest", ctx, challenge, r)
+	ret0, _ := ret[0].(*consent.OAuth2ConsentRequest)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// HandleConsentRequest indicates an expected call of HandleConsentRequest.
+func (mr *MockManagerMockRecorder) HandleConsentRequest(ctx, challenge, r interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "HandleConsentRequest", reflect.TypeOf((*MockManager)(nil).HandleConsentRequest), ctx, challenge, r)
+}
+
+// HandleLoginRequest mocks base method.
+func (m *MockManager) HandleLoginRequest(ctx context.Context, challenge string, r *consent.HandledLoginRequest) (*consent.LoginRequest, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "HandleLoginRequest", ctx, challenge, r)
+	ret0, _ := ret[0].(*consent.LoginRequest)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// HandleLoginRequest indicates an expected call of HandleLoginRequest.
+func (mr *MockManagerMockRecorder) HandleLoginRequest(ctx, challenge, r interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "HandleLoginRequest", reflect.TypeOf((*MockManager)(nil).HandleLoginRequest), ctx, challenge, r)
+}
+
+// ListUserAuthenticatedClientsWithBackChannelLogout mocks base method.
+func (m *MockManager) ListUserAuthenticatedClientsWithBackChannelLogout(ctx context.Context, subject string) ([]client.LoginSessionClient, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ListUserAuthenticatedClientsWithBackChannelLogout", ctx, subject)
+	ret0, _ := ret[0].([]client.LoginSessionClient)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// ListUserAuthenticatedClientsWithBackChannelLogout indicates an expected call of ListUserAuthenticatedClientsWithBackChannelLogout.
+func (mr *MockManagerMockRecorder) ListUserAuthenticatedClientsWithBackChannelLogout(ctx, subject interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListUserAuthenticatedClientsWithBackChannelLogout", reflect.TypeOf((*MockManager)(nil).ListUserAuthenticatedClientsWithBackChannelLogout), ctx, subject)
+}
+
+// ListUserSessionAuthenticatedClientsWithBackChannelLogout mocks base method.
+func (m *MockManager) ListUserSessionAuthenticatedClientsWithBackChannelLogout(ctx context.Context, subject, sid string) ([]client.LoginSessionClient, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ListUserSessionAuthenticatedClientsWithBackChannelLogout", ctx, subject, sid)
+	ret0, _ := ret[0].([]client.LoginSessionClient)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// ListUserSessionAuthenticatedClientsWithBackChannelLogout indicates an expected call of ListUserSessionAuthenticatedClientsWithBackChannelLogout.
+func (mr *MockManagerMockRecorder) ListUserSessionAuthenticatedClientsWithBackChannelLogout(ctx, subject, sid interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListUserSessionAuthenticatedClientsWithBackChannelLogout", reflect.TypeOf((*MockManager)(nil).ListUserSessionAuthenticatedClientsWithBackChannelLogout), ctx, subject, sid)
+}
+
+// ListUserSessionAuthenticatedClientsWithFrontChannelLogout mocks base method.
+func (m *MockManager) ListUserSessionAuthenticatedClientsWithFrontChannelLogout(ctx context.Context, subject, sid string) ([]client.LoginSessionClient, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ListUserSessionAuthenticatedClientsWithFrontChannelLogout", ctx, subject, sid)
+	ret0, _ := ret[0].([]client.LoginSessionClient)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// ListUserSessionAuthenticatedClientsWithFrontChannelLogout indicates an expected call of ListUserSessionAuthenticatedClientsWithFrontChannelLogout.
+func (mr *MockManagerMockRecorder) ListUserSessionAuthenticatedClientsWithFrontChannelLogout(ctx, subject, sid interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListUserSessionAuthenticatedClientsWithFrontChannelLogout", reflect.TypeOf((*MockManager)(nil).ListUserSessionAuthenticatedClientsWithFrontChannelLogout), ctx, subject, sid)
+}
+
+// RejectLogoutRequest mocks base method.
+func (m *MockManager) RejectLogoutRequest(ctx context.Context, challenge string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "RejectLogoutRequest", ctx, challenge)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// RejectLogoutRequest indicates an expected call of RejectLogoutRequest.
+func (mr *MockManagerMockRecorder) RejectLogoutRequest(ctx, challenge interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RejectLogoutRequest", reflect.TypeOf((*MockManager)(nil).RejectLogoutRequest), ctx, challenge)
+}
+
+// RevokeLoginSessionConsentSession mocks base method.
+func (m *MockManager) RevokeLoginSessionConsentSession(ctx context.Context, loginSessionId string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "RevokeLoginSessionConsentSession", ctx, loginSessionId)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// RevokeLoginSessionConsentSession indicates an expected call of RevokeLoginSessionConsentSession.
+func (mr *MockManagerMockRecorder) RevokeLoginSessionConsentSession(ctx, loginSessionId interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RevokeLoginSessionConsentSession", reflect.TypeOf((*MockManager)(nil).RevokeLoginSessionConsentSession), ctx, loginSessionId)
+}
+
+// RevokeSubjectClientConsentSession mocks base method.
+func (m *MockManager) RevokeSubjectClientConsentSession(ctx context.Context, user, client string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "RevokeSubjectClientConsentSession", ctx, user, client)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// RevokeSubjectClientConsentSession indicates an expected call of RevokeSubjectClientConsentSession.
+func (mr *MockManagerMockRecorder) RevokeSubjectClientConsentSession(ctx, user, client interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RevokeSubjectClientConsentSession", reflect.TypeOf((*MockManager)(nil).RevokeSubjectClientConsentSession), ctx, user, client)
+}
+
+// RevokeSubjectClientLoginSessionConsentSession mocks base method.
+func (m *MockManager) RevokeSubjectClientLoginSessionConsentSession(ctx context.Context, user, client, loginSessionId string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "RevokeSubjectClientLoginSessionConsentSession", ctx, user, client, loginSessionId)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// RevokeSubjectClientLoginSessionConsentSession indicates an expected call of RevokeSubjectClientLoginSessionConsentSession.
+func (mr *MockManagerMockRecorder) RevokeSubjectClientLoginSessionConsentSession(ctx, user, client, loginSessionId interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RevokeSubjectClientLoginSessionConsentSession", reflect.TypeOf((*MockManager)(nil).RevokeSubjectClientLoginSessionConsentSession), ctx, user, client, loginSessionId)
+}
+
+// RevokeSubjectConsentSession mocks base method.
+func (m *MockManager) RevokeSubjectConsentSession(ctx context.Context, user string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "RevokeSubjectConsentSession", ctx, user)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// RevokeSubjectConsentSession indicates an expected call of RevokeSubjectConsentSession.
+func (mr *MockManagerMockRecorder) RevokeSubjectConsentSession(ctx, user interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RevokeSubjectConsentSession", reflect.TypeOf((*MockManager)(nil).RevokeSubjectConsentSession), ctx, user)
+}
+
+// RevokeSubjectLoginSession mocks base method.
+func (m *MockManager) RevokeSubjectLoginSession(ctx context.Context, user string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "RevokeSubjectLoginSession", ctx, user)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// RevokeSubjectLoginSession indicates an expected call of RevokeSubjectLoginSession.
+func (mr *MockManagerMockRecorder) RevokeSubjectLoginSession(ctx, user interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RevokeSubjectLoginSession", reflect.TypeOf((*MockManager)(nil).RevokeSubjectLoginSession), ctx, user)
+}
+
+// VerifyAndInvalidateConsentRequest mocks base method.
+func (m *MockManager) VerifyAndInvalidateConsentRequest(ctx context.Context, verifier string) (*consent.AcceptOAuth2ConsentRequest, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "VerifyAndInvalidateConsentRequest", ctx, verifier)
+	ret0, _ := ret[0].(*consent.AcceptOAuth2ConsentRequest)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// VerifyAndInvalidateConsentRequest indicates an expected call of VerifyAndInvalidateConsentRequest.
+func (mr *MockManagerMockRecorder) VerifyAndInvalidateConsentRequest(ctx, verifier interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "VerifyAndInvalidateConsentRequest", reflect.TypeOf((*MockManager)(nil).VerifyAndInvalidateConsentRequest), ctx, verifier)
+}
+
+// VerifyAndInvalidateLoginRequest mocks base method.
+func (m *MockManager) VerifyAndInvalidateLoginRequest(ctx context.Context, verifier string) (*consent.HandledLoginRequest, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "VerifyAndInvalidateLoginRequest", ctx, verifier)
+	ret0, _ := ret[0].(*consent.HandledLoginRequest)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// VerifyAndInvalidateLoginRequest indicates an expected call of VerifyAndInvalidateLoginRequest.
+func (mr *MockManagerMockRecorder) VerifyAndInvalidateLoginRequest(ctx, verifier interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "VerifyAndInvalidateLoginRequest", reflect.TypeOf((*MockManager)(nil).VerifyAndInvalidateLoginRequest), ctx, verifier)
+}
+
+// VerifyAndInvalidateLogoutRequest mocks base method.
+func (m *MockManager) VerifyAndInvalidateLogoutRequest(ctx context.Context, verifier string) (*consent.LogoutRequest, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "VerifyAndInvalidateLogoutRequest", ctx, verifier)
+	ret0, _ := ret[0].(*consent.LogoutRequest)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// VerifyAndInvalidateLogoutRequest indicates an expected call of VerifyAndInvalidateLogoutRequest.
+func (mr *MockManagerMockRecorder) VerifyAndInvalidateLogoutRequest(ctx, verifier interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "VerifyAndInvalidateLogoutRequest", reflect.TypeOf((*MockManager)(nil).VerifyAndInvalidateLogoutRequest), ctx, verifier)
+}
+
+func (m *MockManager) CreateClient(ctx context.Context, c *client.Client) error {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) UpdateClient(ctx context.Context, c *client.Client) error {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) DeleteClient(ctx context.Context, id string) error {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) GetClients(ctx context.Context, filters client.Filter) ([]client.Client, error) {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) CountClients(ctx context.Context) (int, error) {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) GetConcreteClient(ctx context.Context, id string) (*client.Client, error) {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) Authenticate(ctx context.Context, id string, secret []byte) (*client.Client, error) {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) GetClient(ctx context.Context, id string) (fosite.Client, error) {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) ClientAssertionJWTValid(ctx context.Context, jti string) error {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) SetClientAssertionJWT(ctx context.Context, jti string, exp time.Time) error {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) CreateAuthorizeCodeSession(ctx context.Context, code string, request fosite.Requester) (err error) {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) GetAuthorizeCodeSession(ctx context.Context, code string, session fosite.Session) (request fosite.Requester, err error) {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) InvalidateAuthorizeCodeSession(ctx context.Context, code string) (err error) {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) CreateAccessTokenSession(ctx context.Context, signature string, request fosite.Requester) (err error) {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) GetAccessTokenSession(ctx context.Context, signature string, session fosite.Session) (request fosite.Requester, err error) {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) DeleteAccessTokenSession(ctx context.Context, signature string) (err error) {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) CreateRefreshTokenSession(ctx context.Context, signature string, request fosite.Requester) (err error) {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) GetRefreshTokenSession(ctx context.Context, signature string, session fosite.Session) (request fosite.Requester, err error) {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) DeleteRefreshTokenSession(ctx context.Context, signature string) (err error) {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) CreateOpenIDConnectSession(ctx context.Context, authorizeCode string, requester fosite.Requester) error {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) GetOpenIDConnectSession(ctx context.Context, authorizeCode string, requester fosite.Requester) (fosite.Requester, error) {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) GetPKCERequestSession(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error) {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) CreatePKCERequestSession(ctx context.Context, signature string, requester fosite.Requester) error {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) DeletePKCERequestSession(ctx context.Context, signature string) error {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) GetPublicKey(ctx context.Context, issuer string, subject string, keyId string) (*jose.JSONWebKey, error) {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) GetPublicKeys(ctx context.Context, issuer string, subject string) (*jose.JSONWebKeySet, error) {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) GetPublicKeyScopes(ctx context.Context, issuer string, subject string, keyId string) ([]string, error) {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) IsJWTUsed(ctx context.Context, jti string) (bool, error) {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) MarkJWTUsedForTime(ctx context.Context, jti string, exp time.Time) error {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) RevokeRefreshToken(ctx context.Context, requestID string) error {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) RevokeAccessToken(ctx context.Context, requestID string) error {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) FlushInactiveAccessTokens(ctx context.Context, notAfter time.Time, limit int, batchSize int) error {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) FlushInactiveLoginConsentRequests(ctx context.Context, notAfter time.Time, limit int, batchSize int) error {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) DeleteAccessTokens(ctx context.Context, clientID string) error {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) FlushInactiveRefreshTokens(ctx context.Context, notAfter time.Time, limit int, batchSize int) error {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) DeleteOpenIDConnectSession(ctx context.Context, authorizeCode string) error {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) GenerateAndPersistKeySet(ctx context.Context, set, kid, alg, use string) (*jose.JSONWebKeySet, error) {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) AddKey(ctx context.Context, set string, key *jose.JSONWebKey) error {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) AddKeySet(ctx context.Context, set string, keys *jose.JSONWebKeySet) error {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) UpdateKey(ctx context.Context, set string, key *jose.JSONWebKey) error {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) UpdateKeySet(ctx context.Context, set string, keys *jose.JSONWebKeySet) error {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) GetKey(ctx context.Context, set, kid string) (*jose.JSONWebKeySet, error) {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) GetKeySet(ctx context.Context, set string) (*jose.JSONWebKeySet, error) {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) DeleteKey(ctx context.Context, set, kid string) error {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) DeleteKeySet(ctx context.Context, set string) error {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) CreateGrant(ctx context.Context, g trust.Grant, publicKey jose.JSONWebKey) error {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) GetConcreteGrant(ctx context.Context, id string) (trust.Grant, error) {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) DeleteGrant(ctx context.Context, id string) error {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) GetGrants(ctx context.Context, limit, offset int, optionalIssuer string) ([]trust.Grant, error) {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) CountGrants(ctx context.Context) (int, error) {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) FlushInactiveGrants(ctx context.Context, notAfter time.Time, limit int, batchSize int) error {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) MigrationStatus(ctx context.Context) (popx.MigrationStatuses, error) {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) MigrateDown(ctx context.Context, i int) error {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) MigrateUp(ctx context.Context) error {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) PrepareMigration(ctx context.Context) error {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (m *MockManager) Connection(ctx context.Context) *pop.Connection {
+	//TODO implement me
+	panic("implement me")
+}
diff --git a/consent/manager_test_helpers.go b/consent/manager_test_helpers.go
index 0a2133c461f..b7b4f8317b6 100644
--- a/consent/manager_test_helpers.go
+++ b/consent/manager_test_helpers.go
@@ -839,7 +839,7 @@ func ManagerTests(m Manager, clientManager client.Manager, fositeManager x.Fosit
 				}
 
 				for _, ls := range sessions {
-					check := func(t *testing.T, expected map[string][]client.Client, actual []client.Client) {
+					check := func(t *testing.T, expected map[string][]client.Client, actual []client.LoginSessionClient) {
 						es, ok := expected[ls.ID]
 						if !ok {
 							require.Len(t, actual, 0)
@@ -861,14 +861,14 @@ func ManagerTests(m Manager, clientManager client.Manager, fositeManager x.Fosit
 						}
 					}
 
-					t.Run(fmt.Sprintf("method=ListUserAuthenticatedClientsWithFrontChannelLogout/session=%s/subject=%s", ls.ID, ls.Subject), func(t *testing.T) {
-						actual, err := m.ListUserAuthenticatedClientsWithFrontChannelLogout(context.Background(), ls.Subject, ls.ID)
+					t.Run(fmt.Sprintf("method=ListUserSessionAuthenticatedClientsWithFrontChannelLogout/session=%s/subject=%s", ls.ID, ls.Subject), func(t *testing.T) {
+						actual, err := m.ListUserSessionAuthenticatedClientsWithFrontChannelLogout(context.Background(), ls.Subject, ls.ID)
 						require.NoError(t, err)
 						check(t, frontChannels, actual)
 					})
 
-					t.Run(fmt.Sprintf("method=ListUserAuthenticatedClientsWithBackChannelLogout/session=%s", ls.ID), func(t *testing.T) {
-						actual, err := m.ListUserAuthenticatedClientsWithBackChannelLogout(context.Background(), ls.Subject, ls.ID)
+					t.Run(fmt.Sprintf("method=ListUserSessionAuthenticatedClientsWithBackChannelLogout/session=%s", ls.ID), func(t *testing.T) {
+						actual, err := m.ListUserSessionAuthenticatedClientsWithBackChannelLogout(context.Background(), ls.Subject, ls.ID)
 						require.NoError(t, err)
 						check(t, backChannels, actual)
 					})
diff --git a/consent/strategy.go b/consent/strategy.go
index 3ae24d0172a..ed50a7db09f 100644
--- a/consent/strategy.go
+++ b/consent/strategy.go
@@ -16,4 +16,8 @@ type Strategy interface {
 	HandleOAuth2AuthorizationRequest(ctx context.Context, w http.ResponseWriter, r *http.Request, req fosite.AuthorizeRequester) (*AcceptOAuth2ConsentRequest, error)
 	HandleOpenIDConnectLogout(ctx context.Context, w http.ResponseWriter, r *http.Request) (*LogoutResult, error)
 	ObfuscateSubjectIdentifier(ctx context.Context, cl fosite.Client, subject, forcedIdentifier string) (string, error)
+	ExecuteBackChannelLogoutBySession(ctx context.Context, r *http.Request, subject, sid string)
+	ExecuteBackChannelLogoutBySubject(ctx context.Context, r *http.Request, subject string)
+	ExecuteBackChannelLogoutByClient(ctx context.Context, r *http.Request, subject, client string)
+	ExecuteBackChannelLogoutByClientSession(ctx context.Context, r *http.Request, subject, client, sid string)
 }
diff --git a/consent/strategy_default.go b/consent/strategy_default.go
index ecbeccb76e9..e4733347be3 100644
--- a/consent/strategy_default.go
+++ b/consent/strategy_default.go
@@ -627,7 +627,7 @@ func (s *DefaultStrategy) verifyConsent(ctx context.Context, w http.ResponseWrit
 }
 
 func (s *DefaultStrategy) generateFrontChannelLogoutURLs(ctx context.Context, subject, sid string) ([]string, error) {
-	clients, err := s.r.ConsentManager().ListUserAuthenticatedClientsWithFrontChannelLogout(ctx, subject, sid)
+	clients, err := s.r.ConsentManager().ListUserSessionAuthenticatedClientsWithFrontChannelLogout(ctx, subject, sid)
 	if err != nil {
 		return nil, err
 	}
@@ -649,11 +649,15 @@ func (s *DefaultStrategy) generateFrontChannelLogoutURLs(ctx context.Context, su
 }
 
 func (s *DefaultStrategy) executeBackChannelLogout(ctx context.Context, r *http.Request, subject, sid string) error {
-	clients, err := s.r.ConsentManager().ListUserAuthenticatedClientsWithBackChannelLogout(ctx, subject, sid)
+	clients, err := s.r.ConsentManager().ListUserSessionAuthenticatedClientsWithBackChannelLogout(ctx, subject, sid)
 	if err != nil {
 		return err
 	}
 
+	return s.executeBackChannelLogoutForClients(ctx, r, clients)
+}
+
+func (s *DefaultStrategy) executeBackChannelLogoutForClients(ctx context.Context, r *http.Request, clients []client.LoginSessionClient) error {
 	openIDKeyID, err := s.r.OpenIDJWTStrategy().GetPublicKeyID(ctx)
 	if err != nil {
 		return err
@@ -680,7 +684,7 @@ func (s *DefaultStrategy) executeBackChannelLogout(ctx context.Context, r *http.
 			"iat":    time.Now().UTC().Unix(),
 			"jti":    uuid.New(),
 			"events": map[string]struct{}{"http://schemas.openid.net/event/backchannel-logout": {}},
-			"sid":    sid,
+			"sid":    c.LoginSessionID,
 		}, &jwt.Headers{
 			Extra: map[string]interface{}{"kid": openIDKeyID},
 		})
@@ -1032,3 +1036,38 @@ func (s *DefaultStrategy) ObfuscateSubjectIdentifier(ctx context.Context, cl fos
 	}
 	return subject, nil
 }
+
+func (s *DefaultStrategy) ExecuteBackChannelLogoutBySession(ctx context.Context, r *http.Request, subject, sid string) {
+	_ = s.executeBackChannelLogout(ctx, r, subject, sid)
+}
+
+func (s *DefaultStrategy) ExecuteBackChannelLogoutBySubject(ctx context.Context, r *http.Request, subject string) {
+	clients, err := s.r.ConsentManager().ListUserAuthenticatedClientsWithBackChannelLogout(ctx, subject)
+	if err == nil {
+		_ = s.executeBackChannelLogoutForClients(ctx, r, clients)
+	}
+}
+
+func (s *DefaultStrategy) ExecuteBackChannelLogoutByClient(ctx context.Context, r *http.Request, subject, client string) {
+	clients, err := s.r.ConsentManager().ListUserAuthenticatedClientsWithBackChannelLogout(ctx, subject)
+	if err == nil {
+		for i := len(clients) - 1; i >= 0; i-- {
+			if clients[i].LegacyClientID != client {
+				clients = append(clients[:i], clients[i+1:]...)
+			}
+		}
+		_ = s.executeBackChannelLogoutForClients(ctx, r, clients)
+	}
+}
+
+func (s *DefaultStrategy) ExecuteBackChannelLogoutByClientSession(ctx context.Context, r *http.Request, subject, client, sid string) {
+	clients, err := s.r.ConsentManager().ListUserSessionAuthenticatedClientsWithBackChannelLogout(ctx, subject, sid)
+	if err == nil {
+		for i := len(clients) - 1; i >= 0; i-- {
+			if clients[i].LegacyClientID != client {
+				clients = append(clients[:i], clients[i+1:]...)
+			}
+		}
+		_ = s.executeBackChannelLogoutForClients(ctx, r, clients)
+	}
+}
diff --git a/internal/httpclient/api/openapi.yaml b/internal/httpclient/api/openapi.yaml
index b75395441f0..6d758ac7ea0 100644
--- a/internal/httpclient/api/openapi.yaml
+++ b/internal/httpclient/api/openapi.yaml
@@ -1041,6 +1041,16 @@ paths:
         schema:
           type: string
         style: form
+      - description: "If set, deletes only those consent sessions by the Subject that\
+          \ have been granted to the specified session id. Can be combined with client\
+          \ or all parameter."
+        explode: true
+        in: query
+        name: login_session_id
+        required: false
+        schema:
+          type: string
+        style: form
       - description: |-
           Revoke All Consent Sessions
 
@@ -1052,6 +1062,15 @@ paths:
         schema:
           type: boolean
         style: form
+      - description: "If set to `?trigger_back_channel_logout=true`, performs back\
+          \ channel logout for matching clients"
+        explode: true
+        in: query
+        name: trigger_back_channel_logout
+        required: false
+        schema:
+          type: boolean
+        style: form
       responses:
         "204":
           description: "Empty responses are sent when, for example, resources are\
diff --git a/internal/httpclient/docs/OAuth2Api.md b/internal/httpclient/docs/OAuth2Api.md
index bdee97d6a53..10502e9e35f 100644
--- a/internal/httpclient/docs/OAuth2Api.md
+++ b/internal/httpclient/docs/OAuth2Api.md
@@ -1532,7 +1532,7 @@ No authorization required
 
 ## RevokeOAuth2ConsentSessions
 
-> RevokeOAuth2ConsentSessions(ctx).Subject(subject).Client(client).All(all).Execute()
+> RevokeOAuth2ConsentSessions(ctx).Subject(subject).Client(client).LoginSessionId(loginSessionId).All(all).TriggerBackChannelLogout(triggerBackChannelLogout).Execute()
 
 Revoke OAuth 2.0 Consent Sessions of a Subject
 
@@ -1553,11 +1553,13 @@ import (
 func main() {
     subject := "subject_example" // string | OAuth 2.0 Consent Subject  The subject whose consent sessions should be deleted.
     client := "client_example" // string | OAuth 2.0 Client ID  If set, deletes only those consent sessions that have been granted to the specified OAuth 2.0 Client ID. (optional)
+    loginSessionId := "loginSessionId_example" // string | If set, deletes only those consent sessions by the Subject that have been granted to the specified session id. Can be combined with client or all parameter. (optional)
     all := true // bool | Revoke All Consent Sessions  If set to `true` deletes all consent sessions by the Subject that have been granted. (optional)
+    triggerBackChannelLogout := true // bool | If set to `?trigger_back_channel_logout=true`, performs back channel logout for matching clients (optional)
 
     configuration := openapiclient.NewConfiguration()
     apiClient := openapiclient.NewAPIClient(configuration)
-    resp, r, err := apiClient.OAuth2Api.RevokeOAuth2ConsentSessions(context.Background()).Subject(subject).Client(client).All(all).Execute()
+    resp, r, err := apiClient.OAuth2Api.RevokeOAuth2ConsentSessions(context.Background()).Subject(subject).Client(client).LoginSessionId(loginSessionId).All(all).TriggerBackChannelLogout(triggerBackChannelLogout).Execute()
     if err != nil {
         fmt.Fprintf(os.Stderr, "Error when calling `OAuth2Api.RevokeOAuth2ConsentSessions``: %v\n", err)
         fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r)
@@ -1578,7 +1580,9 @@ Name | Type | Description  | Notes
 ------------- | ------------- | ------------- | -------------
  **subject** | **string** | OAuth 2.0 Consent Subject  The subject whose consent sessions should be deleted. | 
  **client** | **string** | OAuth 2.0 Client ID  If set, deletes only those consent sessions that have been granted to the specified OAuth 2.0 Client ID. | 
+ **loginSessionId** | **string** | If set, deletes only those consent sessions by the Subject that have been granted to the specified session id. Can be combined with client or all parameter. | 
  **all** | **bool** | Revoke All Consent Sessions  If set to `true` deletes all consent sessions by the Subject that have been granted. | 
+ **triggerBackChannelLogout** | **bool** | If set to `?trigger_back_channel_logout=true`, performs back channel logout for matching clients | 
 
 ### Return type
 
diff --git a/oauth2/oauth2_helper_test.go b/oauth2/oauth2_helper_test.go
index a1d4f5ad9bb..81c5b2480e6 100644
--- a/oauth2/oauth2_helper_test.go
+++ b/oauth2/oauth2_helper_test.go
@@ -25,6 +25,22 @@ type consentMock struct {
 	requestTime time.Time
 }
 
+func (c *consentMock) ExecuteBackChannelLogoutBySession(ctx context.Context, r *http.Request, subject, sid string) {
+	panic("not implemented")
+}
+
+func (c *consentMock) ExecuteBackChannelLogoutBySubject(ctx context.Context, r *http.Request, subject string) {
+	panic("not implemented")
+}
+
+func (c *consentMock) ExecuteBackChannelLogoutByClient(ctx context.Context, r *http.Request, subject, client string) {
+	panic("not implemented")
+}
+
+func (c *consentMock) ExecuteBackChannelLogoutByClientSession(ctx context.Context, r *http.Request, subject, client, sid string) {
+	panic("not implemented")
+}
+
 func (c *consentMock) HandleOAuth2AuthorizationRequest(ctx context.Context, w http.ResponseWriter, r *http.Request, req fosite.AuthorizeRequester) (*consent.AcceptOAuth2ConsentRequest, error) {
 	if c.deny {
 		return nil, fosite.ErrRequestForbidden
diff --git a/persistence/sql/persister_consent.go b/persistence/sql/persister_consent.go
index a93f60a7705..02aedd183a6 100644
--- a/persistence/sql/persister_consent.go
+++ b/persistence/sql/persister_consent.go
@@ -35,6 +35,13 @@ func (p *Persister) RevokeSubjectConsentSession(ctx context.Context, user string
 	return p.transaction(ctx, p.revokeConsentSession("consent_challenge_id IS NOT NULL AND subject = ?", user))
 }
 
+func (p *Persister) RevokeLoginSessionConsentSession(ctx context.Context, loginSessionId string) error {
+	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.RevokeLoginSessionConsentSession")
+	defer span.End()
+
+	return p.transaction(ctx, p.revokeConsentSession("consent_challenge_id IS NOT NULL AND login_session_id = ?", loginSessionId))
+}
+
 func (p *Persister) RevokeSubjectClientConsentSession(ctx context.Context, user, client string) error {
 	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.RevokeSubjectClientConsentSession")
 	defer span.End()
@@ -42,6 +49,13 @@ func (p *Persister) RevokeSubjectClientConsentSession(ctx context.Context, user,
 	return p.transaction(ctx, p.revokeConsentSession("consent_challenge_id IS NOT NULL AND subject = ? AND client_id = ?", user, client))
 }
 
+func (p *Persister) RevokeSubjectClientLoginSessionConsentSession(ctx context.Context, user, client, loginSessionId string) error {
+	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.RevokeSubjectClientLoginSessionConsentSession")
+	defer span.End()
+
+	return p.transaction(ctx, p.revokeConsentSession("consent_challenge_id IS NOT NULL AND subject = ? AND client_id = ? AND login_session_id = ?", user, client, loginSessionId))
+}
+
 func (p *Persister) revokeConsentSession(whereStmt string, whereArgs ...interface{}) func(context.Context, *pop.Connection) error {
 	return func(ctx context.Context, c *pop.Connection) error {
 		fs := make([]*flow.Flow, 0)
@@ -535,29 +549,35 @@ func (p *Persister) filterExpiredConsentRequests(ctx context.Context, requests [
 	return result, nil
 }
 
-func (p *Persister) ListUserAuthenticatedClientsWithFrontChannelLogout(ctx context.Context, subject, sid string) ([]client.Client, error) {
-	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.ListUserAuthenticatedClientsWithFrontChannelLogout")
+func (p *Persister) ListUserSessionAuthenticatedClientsWithFrontChannelLogout(ctx context.Context, subject, sid string) ([]client.LoginSessionClient, error) {
+	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.ListUserSessionAuthenticatedClientsWithFrontChannelLogout")
 	defer span.End()
 
-	return p.listUserAuthenticatedClients(ctx, subject, sid, "front")
+	return p.listUserSessionAuthenticatedClients(ctx, subject, sid, "front")
+}
+
+func (p *Persister) ListUserSessionAuthenticatedClientsWithBackChannelLogout(ctx context.Context, subject, sid string) ([]client.LoginSessionClient, error) {
+	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.ListUserSessionAuthenticatedClientsWithBackChannelLogout")
+	defer span.End()
+	return p.listUserSessionAuthenticatedClients(ctx, subject, sid, "back")
 }
 
-func (p *Persister) ListUserAuthenticatedClientsWithBackChannelLogout(ctx context.Context, subject, sid string) ([]client.Client, error) {
-	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.ListUserAuthenticatedClientsWithBackChannelLogout")
+func (p *Persister) ListUserAuthenticatedClientsWithBackChannelLogout(ctx context.Context, subject string) ([]client.LoginSessionClient, error) {
+	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.ListUserSessionAuthenticatedClientsWithBackChannelLogout")
 	defer span.End()
-	return p.listUserAuthenticatedClients(ctx, subject, sid, "back")
+	return p.listUserAuthenticatedClients(ctx, subject, "back")
 }
 
-func (p *Persister) listUserAuthenticatedClients(ctx context.Context, subject, sid, channel string) ([]client.Client, error) {
+func (p *Persister) listUserSessionAuthenticatedClients(ctx context.Context, subject, sid, channel string) ([]client.LoginSessionClient, error) {
 	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.listUserAuthenticatedClients")
 	defer span.End()
 
-	var cs []client.Client
+	var cs []client.LoginSessionClient
 	return cs, p.transaction(ctx, func(ctx context.Context, c *pop.Connection) error {
 		if err := c.RawQuery(
 			/* #nosec G201 - channel can either be "front" or "back" */
 			fmt.Sprintf(`
-SELECT DISTINCT c.* FROM hydra_client as c
+SELECT DISTINCT c.*, f.login_session_id FROM hydra_client as c
 JOIN hydra_oauth2_flow as f ON (c.id = f.client_id)
 WHERE
 	f.subject=? AND
@@ -581,6 +601,37 @@ WHERE
 	})
 }
 
+func (p *Persister) listUserAuthenticatedClients(ctx context.Context, subject, channel string) ([]client.LoginSessionClient, error) {
+	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.listUserAuthenticatedClients")
+	defer span.End()
+
+	var cs []client.LoginSessionClient
+	return cs, p.transaction(ctx, func(ctx context.Context, c *pop.Connection) error {
+		if err := c.RawQuery(
+			/* #nosec G201 - channel can either be "front" or "back" */
+			fmt.Sprintf(`
+SELECT DISTINCT c.*, f.login_session_id FROM hydra_client as c
+JOIN hydra_oauth2_flow as f ON (c.id = f.client_id)
+WHERE
+	f.subject=? AND
+	c.%schannel_logout_uri!='' AND
+	c.%schannel_logout_uri IS NOT NULL AND
+	f.nid = ? AND
+	c.nid = ?`,
+				channel,
+				channel,
+			),
+			subject,
+			p.NetworkID(ctx),
+			p.NetworkID(ctx),
+		).All(&cs); err != nil {
+			return sqlcon.HandleError(err)
+		}
+
+		return nil
+	})
+}
+
 func (p *Persister) CreateLogoutRequest(ctx context.Context, request *consent.LogoutRequest) error {
 	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.CreateLogoutRequest")
 	defer span.End()
diff --git a/persistence/sql/persister_nid_test.go b/persistence/sql/persister_nid_test.go
index ae4410a4af4..16f5b0e6eac 100644
--- a/persistence/sql/persister_nid_test.go
+++ b/persistence/sql/persister_nid_test.go
@@ -1514,11 +1514,11 @@ func (s *PersisterTestSuite) TestListUserAuthenticatedClientsWithBackChannelLogo
 			_, err = r.Persister().HandleConsentRequest(s.t2, &consent.AcceptOAuth2ConsentRequest{ID: t2f2.ID, HandledAt: sqlxx.NullTime(time.Now()), Remember: true})
 			require.NoError(t, err)
 
-			cs, err := r.Persister().ListUserAuthenticatedClientsWithBackChannelLogout(s.t1, "sub", t1f1.SessionID.String())
+			cs, err := r.Persister().ListUserSessionAuthenticatedClientsWithBackChannelLogout(s.t1, "sub", t1f1.SessionID.String())
 			require.NoError(t, err)
 			require.Equal(t, 1, len(cs))
 
-			cs, err = r.Persister().ListUserAuthenticatedClientsWithBackChannelLogout(s.t2, "sub", t1f1.SessionID.String())
+			cs, err = r.Persister().ListUserSessionAuthenticatedClientsWithBackChannelLogout(s.t2, "sub", t1f1.SessionID.String())
 			require.NoError(t, err)
 			require.Equal(t, 2, len(cs))
 		})
@@ -1568,11 +1568,11 @@ func (s *PersisterTestSuite) TestListUserAuthenticatedClientsWithFrontChannelLog
 			_, err = r.Persister().HandleConsentRequest(s.t2, &consent.AcceptOAuth2ConsentRequest{ID: t2f2.ID, HandledAt: sqlxx.NullTime(time.Now()), Remember: true})
 			require.NoError(t, err)
 
-			cs, err := r.Persister().ListUserAuthenticatedClientsWithFrontChannelLogout(s.t1, "sub", t1f1.SessionID.String())
+			cs, err := r.Persister().ListUserSessionAuthenticatedClientsWithFrontChannelLogout(s.t1, "sub", t1f1.SessionID.String())
 			require.NoError(t, err)
 			require.Equal(t, 1, len(cs))
 
-			cs, err = r.Persister().ListUserAuthenticatedClientsWithFrontChannelLogout(s.t2, "sub", t1f1.SessionID.String())
+			cs, err = r.Persister().ListUserSessionAuthenticatedClientsWithFrontChannelLogout(s.t2, "sub", t1f1.SessionID.String())
 			require.NoError(t, err)
 			require.Equal(t, 2, len(cs))
 		})
diff --git a/spec/api.json b/spec/api.json
index d439715e270..4108f69fd0b 100644
--- a/spec/api.json
+++ b/spec/api.json
@@ -2733,6 +2733,14 @@
               "type": "string"
             }
           },
+          {
+            "description": "If set, deletes only those consent sessions by the Subject that have been granted to the specified session id. Can be combined with client or all parameter.",
+            "in": "query",
+            "name": "login_session_id",
+            "schema": {
+              "type": "string"
+            }
+          },
           {
             "description": "Revoke All Consent Sessions\n\nIf set to `true` deletes all consent sessions by the Subject that have been granted.",
             "in": "query",
@@ -2740,6 +2748,14 @@
             "schema": {
               "type": "boolean"
             }
+          },
+          {
+            "description": "If set to `?trigger_back_channel_logout=true`, performs back channel logout for matching clients",
+            "in": "query",
+            "name": "trigger_back_channel_logout",
+            "schema": {
+              "type": "boolean"
+            }
           }
         ],
         "responses": {
diff --git a/spec/swagger.json b/spec/swagger.json
index a1921533f02..394b4b23559 100755
--- a/spec/swagger.json
+++ b/spec/swagger.json
@@ -1258,11 +1258,23 @@
             "name": "client",
             "in": "query"
           },
+          {
+            "type": "string",
+            "description": "If set, deletes only those consent sessions by the Subject that have been granted to the specified session id. Can be combined with client or all parameter.",
+            "name": "login_session_id",
+            "in": "query"
+          },
           {
             "type": "boolean",
             "description": "Revoke All Consent Sessions\n\nIf set to `true` deletes all consent sessions by the Subject that have been granted.",
             "name": "all",
             "in": "query"
+          },
+          {
+            "type": "boolean",
+            "description": "If set to `?trigger_back_channel_logout=true`, performs back channel logout for matching clients",
+            "name": "trigger_back_channel_logout",
+            "in": "query"
           }
         ],
         "responses": {