Session aware logout, backend logout url approach - #1876

I can't do much for legacyProviderFlagSet LoC count :/

This pull request has been inactive for 60 days. If the pull request is still relevant please comment to re-activate the pull request. If no action is taken within 7 days, the pull request will be marked closed.

Still relevant;)

Apologies for not getting to this, I hope to review soon, looks like there are a couple of conflicts in the keycloak code at the moment, do we want to get those resolved?

Conflicts resolved, ready to merge.

This pull request has been inactive for 60 days. If the pull request is still relevant please comment to re-activate the pull request. If no action is taken within 7 days, the pull request will be marked closed.

Not stale

Thank you for that, would love to see it merged soon!

This pull request has been inactive for 60 days. If the pull request is still relevant please comment to re-activate the pull request. If no action is taken within 7 days, the pull request will be marked closed.

Still relevent

This pull request has been inactive for 60 days. If the pull request is still relevant please comment to re-activate the pull request. If no action is taken within 7 days, the pull request will be marked closed.

.

This pull request has been inactive for 60 days. If the pull request is still relevant please comment to re-activate the pull request. If no action is taken within 7 days, the pull request will be marked closed.

.

This pull request has been inactive for 60 days. If the pull request is still relevant please comment to re-activate the pull request. If no action is taken within 7 days, the pull request will be marked closed.

Rebased against master

Rebased against master

Excellent. When is the next release scheduled?

Hello, please write some documentation, the description is scant, what should I do about it? do I understand correctly that the application should follow http://app.app.example/logout where nginx location follows in
this link http://localhost:4180/oauth2/sign_out?rd=http://localhost:8080/auth/realms/testrealm/protocol/openid-connect/logout?id_token_hint={id_token}%26post_logout_redirect_uri=http:// localhost:4180/
what then should be in the backend-logout-url

Several logout methods has been considered but as id_token is a pretty sensitive information, backend logout has beeen privilegied.

You have to consider 2 course of actions when you send the browser to the sign_out endpoint, running in parallel:

• Client side you want the browser to be redirected on a gien url (the rd parameter in qs)
• Server to server call from oauth2-proxy to your oidc provider (keycloak) through a secure channel with pattern replacement containing the sensitive info

So http://localhost:8080/auth/realms/testrealm/protocol/openid-connect/logout?id_token_hint={id_token} goes into --backend-logout-url and http://localhost:4180/ goes to rd argument of sign_out.

Hello, please write some documentation, the description is scant, what should I do about it? do I understand correctly that the application should follow http://app.app.example/logout where nginx location follows in this link http://localhost:4180/oauth2/sign_out?rd=http://localhost:8080/auth/realms/testrealm/protocol/openid-connect/logout?id_token_hint={id_token}%26post_logout_redirect_uri=http:// localhost:4180/ what then should be in the backend-logout-url

I was able to get this to work with NGINX proxy and Keycloak OIDC provider:

OAuth2proxy config file entry:

backend_logout_url="http://keycloak.local/realms/redeye/protocol/openid-connect/logout?post_logout_redirect_uri=https%3A%2F%2Fapp.local&id_token_hint={id_token}"

NGINX entry:

# Logout route
location /logout {
        proxy_pass http://oauth2-proxy:4180/oauth2/sign_out; 

        include       /etc/nginx/proxy_params;
        proxy_set_header Cookie                  $http_cookie;  # Forward session cookies
    }

Good news.
But again you don't need to specify post_logout_redirect_uri keycloak parameter in oauth2-proxy's backend_logout_url option.

Good news. But again you don't need to specify post_logout_redirect_uri keycloak parameter in oauth2-proxy's backend_logout_url option.

Thanks for the response! I tested it, and it works just as you described. Here's an updated config snippet for reference to help others:

backend_logout_url="http://keycloak.local/realms/redeye/protocol/openid-connect/logout?id_token_hint={id_token}"

Glad to hear that ;)

Good news. But again you don't need to specify post_logout_redirect_uri keycloak parameter in oauth2-proxy's backend_logout_url option.

Why? How to back in app?
mb this need add to nginx conf ?
location /logout {
proxy_pass http://oauth2-proxy:4180/oauth2/sign_out?rd=https://myapp.local;

More like that, yes ;)