Bug 31900 - Add support for logout from external OAuth2/OIDC identity providers
Summary: Add support for logout from external OAuth2/OIDC identity providers
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low new feature
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on: 31378
Blocks:
  Show dependency tree / graph
 
Reported: 2022-10-20 23:16 UTC by Tomás Cohen Arazi (tcohen)
Modified: 2022-11-09 02:33 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Tomás Cohen Arazi (tcohen) 2022-10-20 23:16:52 UTC 

    


    


      



        
          Comment 1
        

        
          David Cook

        

        
        

        
          2022-11-09 02:18:27 UTC
        

      






In order to do this, I think that we'd need to store a reference in the user's database session to the identity provider that was used when logging in. 

Perhaps "identity_provider: X" would be enough. Or potentially "identity_provider_logout" with the logout URL, so that we don't have to re-fetch the "end_session_endpoint" via the well_known_url.

    


    


      



        
          Comment 2
        

        
          Tomás Cohen Arazi (tcohen)

        

        
        

        
          2022-11-09 02:22:29 UTC
        

      






The logout URL is retrieved during the OIDC warm up, and reused. Alternatively, it can be set in the config, and the plugin will use it.

And yes, we need to add the idp reference on the session. 

It should also be configurable with 3 options
- No logout
- Automatic logout
- Give the option to logout

    


    


      



        
          Comment 3
        

        
          David Cook

        

        
        

        
          2022-11-09 02:33:24 UTC
        

      






Sounds good to me.