Implement OIDC back-channel-logout

[guimard]

As describe in TWP linagora/twake-workplace-private#99, we want to have logout. The only unbuggy way to do it is to use OIDC Back Channel Logout like Twake-Mail and Twake-Chat.

Please implement it _(with backchannel_logout_session_required, to avoid deleting all sessions)_.

[shepilov]

• [ ] Implements session storage with sub/sid
• [ ] Add sid to the Twake Drive access token
• [ ] Validate sid on every Twake Drive request
• [ ] Implement backchannel logout URI with logout token validation

[shepilov]

@guimard logout URL should be with POST like this?

/backchannel_logout HTTP/1.1 Host: rp.example.org Content-Type: application/x-www-form-urlencoded logout_token=eyJhbGci...

[guimard]

@guimard logout URL should be with POST like this?

/backchannel_logout HTTP/1.1 Host: rp.example.org Content-Type: application/x-www-form-urlencoded logout_token=eyJhbGci...

Yes this is exactly what OP does

[guimard]

Hi @shepilov, could you give me the URL to set in LLNG conf ?

[shepilov]

@guimard https://drive.stg.lin-saas.com/internal/services/console/v1/backchannel_logout I've just deployed it on the staging

[guimard]

Configuration updated, let's test. Note that it may fail until @rezk2ll study the new flow