Hi Raja,
As the cookies are set per browser process, just closing the tab won't remove
the cookie for def.xyz.com. This is by browser design. To explicitly ask the
browser to remove the cookie, you need to set logoffuri ACO parameter. The user
needs to click on a specific link to logoff that cookie in def.xyz.com before
closing the tab.
Or as you mentionned :
"[...] and click a link to def.xyz.com which will be opened in a second tab."
you might consider to open the site in a new browser window instead of a tab. So
when the user will close the Windows, it will lost the cookie for "def.xyz.com".
Or find for the browser a tool capable to do this. To illustrate, for firefox, it
seems there are such an add-on :
http://www.addictivetips.com/web/set-firefox-to-auto-delete-site-cookies-on-closing-tabs-or-browser/
I hope this helps,
Best Regards,
Patrick