search

revomatico / kong-oidc

OIDC plugin for Kong
Apache License 2.0
110 stars 75 forks source link

Improve logout logic #15

Closed dmitrysleptsov closed 2 years ago

dmitrysleptsov commented 2 years ago

Hi guys

First of all, thank you very much for doing such a good work with this plugin 😃 . I write this issue here, because the original repository is not supported and I'm using yours.

I created a PR to add more parameters to schema so it will be possible to configure logout. Now there are several problems:

  1. There are no possibility to revoce access_token and id_token. It's possible with revoke_tokens_on_logout setting (this setting exists in schema.lua, but not processed in utils.lua).
  2. No possibility to redirect to desired page after redirecting to logout endpoint of OIDC provider (it's implemented in lua-resty-openidc https://github.com/zmartzone/lua-resty-openidc/blob/7d72f45117c1da472664ff9d10de573343d56d7b/lib/resty/openidc.lua#L1331). It's possible now with post_logout_redirect_uri setting.
  3. Don't know about other providers, but Okta requires id_token_hint to be present in logout request. It's possible with redirect_after_logout_with_id_token_hint setting.

It would be great if you can review changes in this PR https://github.com/revomatico/kong-oidc/pull/16

mmadoo commented 2 years ago

I would also need this PR as since keycloak 18, id_token_hint is recommended for logout. See https://www.keycloak.org/docs/latest/server_admin/#_oidc-logout