search

bcgov / entity

ServiceBC Registry Team working on Legal Entities
Apache License 2.0
23 stars 59 forks source link

SBC-Common-Components - Logout not clearing SiteMinder cookies - InvalidFederatedIdentityActionMessage #12565

Closed seeker25 closed 2 years ago

seeker25 commented 2 years ago

Currently we're logging out of keycloak, but not logging out of SiteMinder.

This causes issues when you try to login with a different BCEID or IDIR account. (BC Service Card accounts aren't affected).

Steps to reproduce:

  1. Close all browser instances
  2. Open Chrome
  3. Login with BCeID/IDIR account A
  4. Log out
  5. Login with BCeID/IDIR account B
  6. You'll see the error:

image.png

What we're currently calling (example from DEV): https://dev.oidc.gov.bc.ca/auth/realms/fcf0kpqr/protocol/openid-connect/logout?redirect_uri=https%3A%2F%2Fyfthig-dev.web.app%2F%2Flogin

We'd need to change the logout to call logon7.gov.bc.ca (that wipes SiteMinder cookies): https://logon7.gov.bc.ca/clp-cgi/logoff.cgi?returl=https://dev.oidc.gov.bc.ca/auth/realms/fcf0kpqr/protocol/openid-connect/logout?post_logout_redirect_uri=https://dev.bcregistry.ca/business/auth/&retnow=1

Reference from bcgov/sso: https://github.com/bcgov/ocp-sso/issues/4

seeker25 commented 2 years ago

image.png

What roughly should happen -^