search

ch4mpy / spring-addons

Ease spring OAuth2 resource-servers configuration and testing
Apache License 2.0
521 stars 84 forks source link

Fix the possibility to override the logout request uri (end_session endpoint) #195

Closed kriszman closed 5 months ago

kriszman commented 5 months ago

Came across this project after reading an article on Baeldung who linked it for good reason. It's really amazing and I'm really glad I stumbled across it as it's more than helpful setting up and generally getting into oidc and authentication. However, I had some issues trying to override the end session endpoint provided by the OP discovery as described in the README. When specifying an alternative url in the application properties (oauth2-logout) this url isn't recognized, so I tried to adapt the corresponding parts. Hope this makes sense, thx.

ch4mpy commented 5 months ago

@kriszman thank you again for your investigations and fix.

I'll release this patch in the next 8-10 hours (don't have the required GPG keys at hand) and will ping you when the new version is available from maven-central.

kriszman commented 5 months ago

@kriszman thank you again for your investigations and fix.

I'll release this patch in the next 8-10 hours (don't have the required GPG keys at hand) and will ping you when the new version is available from maven-central.

no worries, it's been really a small issue, happy I could assist a little. Thank you for this amazing library, hope it keeps on going... and thx for keeping me posted 👍

ch4mpy commented 5 months ago

@kriszman the 7.6.6 is available from maven-central. It contains your fix.

ch4mpy commented 5 months ago

@kriszman the version to use is actually 7.6.7. There was still a small issue with the condition to de-activate RP-Initiated Logout: in case where logout properties are not provided at all, we want to keep RP-Initiated Logout => de-activation "not true"

kriszman commented 5 months ago

@kriszman the version to use is actually 7.6.7. There was still a small issue with the condition to de-activate RP-Initiated Logout: in case where logout properties are not provided at all, we want to keep RP-Initiated Logout => de-activation "not true"

@ch4mpy I see, seems like I've been too focused on my use case, sorry for the inconvenience and thx for the fast feedback and fix!