search

finalist / liferay-oidc-plugin

Plugin for Liferay, enabling OpenID Connect authentication
Apache License 2.0
21 stars 31 forks source link

Add support for SSO logout #17

Closed zipwiz closed 6 years ago

zipwiz commented 6 years ago

The LR62 filter is extended to process /c/portal/logout also and optionally redirect this request to a configured OIDC SSO logout URI.

From there the request should be redirected back to the Liferay Portal Home Page or any other public Portal resource. This may be configured at the OIDC service if available, or a reditect URL parameter may be configured also.

Do not redirect back to /c/portal/logout because this woud cause an infinite redirect loop!

zipwiz commented 6 years ago

See #10

gvanderploeg commented 6 years ago

Thanks for your effort for this issue. At first glance the code seems quite OK to me. Few things though:

  1. This I probably could have told you beforehand: the Filter classes (both 6.2 and 7.0) were meant to only 'obey' to the version specific portlet filter APIs, but delegate as much functionality as possible to the version-independent 'lib' component. As an example, the existing login logic: FilterResult filterResult = libFilter.processFilter(request, response, filterChain); But no problem, when integrating this pull request I will refactor this, and also test it for DXP/7.0 while I'm at it.

  2. this is more fundamental: the universal (portlet) filter logic dictates that you pass on control to the chain when you're done with your own logic. In Liferay this happens when calling processFilter(getClass(), request, response, filterChain);. See the original version for how we implemented this until now. For the /logout logic you should add this as well, otherwise the chain and any other filters down the chain won't get the request anymore.

zipwiz commented 6 years ago

Since moving the logic to LibFilter will also support fixing the filter chain processing I will change both accordingly.

zipwiz commented 6 years ago

Successfully tested with OIDC Plugin activated and all parameters set.

Not yet tested when plugin is inactive. This should now also switch off SSO logout.

In theory this may work OOTB for DXP also, if the filter configuration is setup accordingly.