Bug 31900 - Add support for logout from external OAuth2/OIDC identity providers
Summary: Add support for logout from external OAuth2/OIDC identity providers
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low new feature with 10 votes (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on: 31378
Blocks:
  Show dependency treegraph
 
Reported: 2022-10-20 23:16 UTC by Tomás Cohen Arazi
Modified: 2022-11-09 02:33 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Tomás Cohen Arazi 2022-10-20 23:16:52 UTC

    
Comment 1 David Cook 2022-11-09 02:18:27 UTC
In order to do this, I think that we'd need to store a reference in the user's database session to the identity provider that was used when logging in. 

Perhaps "identity_provider: X" would be enough. Or potentially "identity_provider_logout" with the logout URL, so that we don't have to re-fetch the "end_session_endpoint" via the well_known_url.
Comment 2 Tomás Cohen Arazi 2022-11-09 02:22:29 UTC
The logout URL is retrieved during the OIDC warm up, and reused. Alternatively, it can be set in the config, and the plugin will use it.

And yes, we need to add the idp reference on the session. 

It should also be configurable with 3 options
- No logout
- Automatic logout
- Give the option to logout
Comment 3 David Cook 2022-11-09 02:33:24 UTC
Sounds good to me.