| Summary: | Add support for logout from external OAuth2/OIDC identity providers | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Tomás Cohen Arazi (tcohen) <tomascohen> |
| Component: | Authentication | Assignee: | Bugs List <koha-bugs> |
| Status: | NEW --- | QA Contact: | Testopia <testopia> |
| Severity: | new feature | ||
| Priority: | P5 - low | CC: | dcook, dpavlin |
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | All | ||
| Change sponsored?: | --- | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
| Bug Depends on: | 31378 | ||
| Bug Blocks: | |||
|
Description
Tomás Cohen Arazi (tcohen)
2022-10-20 23:16:52 UTC
In order to do this, I think that we'd need to store a reference in the user's database session to the identity provider that was used when logging in. Perhaps "identity_provider: X" would be enough. Or potentially "identity_provider_logout" with the logout URL, so that we don't have to re-fetch the "end_session_endpoint" via the well_known_url. The logout URL is retrieved during the OIDC warm up, and reused. Alternatively, it can be set in the config, and the plugin will use it. And yes, we need to add the idp reference on the session. It should also be configurable with 3 options - No logout - Automatic logout - Give the option to logout Sounds good to me. |