Bug 31900

Summary: Add support for logout from external OAuth2/OIDC identity providers
Product: Koha Reporter: Tomás Cohen Arazi <tomascohen>
Component: AuthenticationAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: new feature    
Priority: P5 - low CC: dcook, dpavlin
Version: unspecified   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on: 31378    
Bug Blocks:    

Description Tomás Cohen Arazi 2022-10-20 23:16:52 UTC

    
Comment 1 David Cook 2022-11-09 02:18:27 UTC
In order to do this, I think that we'd need to store a reference in the user's database session to the identity provider that was used when logging in. 

Perhaps "identity_provider: X" would be enough. Or potentially "identity_provider_logout" with the logout URL, so that we don't have to re-fetch the "end_session_endpoint" via the well_known_url.
Comment 2 Tomás Cohen Arazi 2022-11-09 02:22:29 UTC
The logout URL is retrieved during the OIDC warm up, and reused. Alternatively, it can be set in the config, and the plugin will use it.

And yes, we need to add the idp reference on the session. 

It should also be configurable with 3 options
- No logout
- Automatic logout
- Give the option to logout
Comment 3 David Cook 2022-11-09 02:33:24 UTC
Sounds good to me.