Bug 31900 - Add support for logout from external OAuth2/OIDC identity providers
Summary: Add support for logout from external OAuth2/OIDC identity providers
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low new feature
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on: 31378
Blocks:
  Show dependency treegraph
 
Reported: 2022-10-20 23:16 UTC by Tomás Cohen Arazi (tcohen)
Modified: 2025-08-06 23:30 UTC (History)
4 users (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Tomás Cohen Arazi (tcohen) 2022-10-20 23:16:52 UTC

    
Comment 1 David Cook 2022-11-09 02:18:27 UTC
In order to do this, I think that we'd need to store a reference in the user's database session to the identity provider that was used when logging in. 

Perhaps "identity_provider: X" would be enough. Or potentially "identity_provider_logout" with the logout URL, so that we don't have to re-fetch the "end_session_endpoint" via the well_known_url.
Comment 2 Tomás Cohen Arazi (tcohen) 2022-11-09 02:22:29 UTC
The logout URL is retrieved during the OIDC warm up, and reused. Alternatively, it can be set in the config, and the plugin will use it.

And yes, we need to add the idp reference on the session. 

It should also be configurable with 3 options
- No logout
- Automatic logout
- Give the option to logout
Comment 3 David Cook 2022-11-09 02:33:24 UTC
Sounds good to me.
Comment 4 Alex Buckley 2025-07-29 23:03:15 UTC
Hi all,

As this bug report is a few years old. Could you please clarify for me. 

Does Koha now have support for logout from external OAuth2/OIDC identity providers or not?

Thanks
Alex
Comment 5 David Cook 2025-07-29 23:38:58 UTC
(In reply to Alex Buckley from comment #4)
> Hi all,
> 
> As this bug report is a few years old. Could you please clarify for me. 
> 
> Does Koha now have support for logout from external OAuth2/OIDC identity
> providers or not?
> 
> Thanks
> Alex

I don't think so. 

I don't have any plans to work on this either, as I don't have anyone asking for it. My next OIDC related task would be to return to page initiating the OIDC login. 

Happy to support anyone that wants to do this work though.
Comment 6 Alex Buckley 2025-07-29 23:45:44 UTC
(In reply to David Cook from comment #5)
> (In reply to Alex Buckley from comment #4)
> > Hi all,
> > 
> > As this bug report is a few years old. Could you please clarify for me. 
> > 
> > Does Koha now have support for logout from external OAuth2/OIDC identity
> > providers or not?
> > 
> > Thanks
> > Alex
> 
> I don't think so. 
> 
> I don't have any plans to work on this either, as I don't have anyone asking
> for it. My next OIDC related task would be to return to page initiating the
> OIDC login. 
> 
> Happy to support anyone that wants to do this work though.

Thanks very much David!

We have a partner library who are running 24.11 who are using OIDC for authentication. When they log out of the Koha staff client they encounter a 'There was an error authenticating to external identity provider wrong_csrf_token'.

So I am trying to establish if that is because Koha doesnt support OIDC logout or something else.

Have you ever encountered that problem before?
Comment 7 David Cook 2025-07-30 00:25:24 UTC
(In reply to Alex Buckley from comment #6)
> Thanks very much David!
> 
> We have a partner library who are running 24.11 who are using OIDC for
> authentication. When they log out of the Koha staff client they encounter a
> 'There was an error authenticating to external identity provider
> wrong_csrf_token'.
> 
> So I am trying to establish if that is because Koha doesnt support OIDC
> logout or something else.
>
> Have you ever encountered that problem before?

No, I don't think that would relate to Koha supporting OIDC logout from the IdP. 

In fact, based off the description, this doesn't sound like the full story. To me, it sounds like they've logged out via OIDC and then tried to login via OIDC again.

Sounds like you've got some troubleshooting to do. But Koha won't be trying to initiate a OIDC logout from the IdP so I'd say it's not related to bug 31900.
Comment 8 David Cook 2025-07-30 00:26:46 UTC
@Alex something you might want to consider is bug 33259. That may or may not be related to your issue.
Comment 9 Alex Buckley 2025-07-30 00:27:32 UTC
(In reply to David Cook from comment #8)
> @Alex something you might want to consider is bug 33259. That may or may not
> be related to your issue.

Many thanks David for this and your previous comment, appreciate it!