search

openanalytics / containerproxy

Manage HTTP proxy routes into Docker containers
Apache License 2.0
45 stars 66 forks source link

OIDC Logout Route for Okta Not Supported #56

Closed k----n closed 2 years ago

k----n commented 3 years ago

The logout route for Okta OIDC requires the logout token.

LEDfan commented 3 years ago

Hi @k----n

I can indeed see from the documentation that providing the ID token is required for Okta. I saw your PR, first of all thanks for your contribution! The only problem I see is that this contribution is quite specific to Okta. As we want to support many authentication providers, I would prefer a more generic solution over a provider-specific solution. Therefore I wonder whether we should enable SpeL support on the logout property. Together with another upcoming change to our SpEL functionality, this would allow you to provide the following configuration:

proxy:
  authentication: openid
    logout-url: https://okta.com/logout?id_token_hint=#{oidcUser.idToken.tokenValue}&post_logout_redirect_uri=my_redirect_uro

The ID token is then automatically filled in. When this change is implemented, we don't have to change ShinyProxy again, when another provider requires some other parameters (or other name for the id token).

What do you think?

k----n commented 3 years ago

Perfect, if SpeL is enabled that could also work!

LEDfan commented 2 years ago

ShinyProxy 2.6.0 (ContainerProxy 0.8.10) now support SpEL in the logout property.

Thank you for the suggestion!