The reason for this "Access forbidden!" error is described here - https://wiki.jenkins.io/display/JENKINS/ CSRF +Protection Jenkins_4.5.1_1_70 plugin does not support Jenkins server with CSRF Protection enabled. You can disable CSRF Protection in Jenkins server in "Manage Jenkins" - "Configure Global Security" section.
This issue is due to adding CSRF token requirement to the SSO logout entry points. The client (VM) has earlier SSO libraries that do not include CSRF token on logout.