Uploaded image for project: 'OpenId Connect'
  1. OpenId Connect
  2. OIDC-324

Logout does not log out from the provider when the standard authenticator is disabled

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • Major
    • 2.29.1
    • 2.24.0
    • Authenticator
    • None
    • Unit, Integration
    • Unknown

    Description

      When the standard authenticator is disabled (oidc.tryLocal=false in xwiki.properties, or "Is standard authenticator allowed?" unchecked in the client configuration), logging out of XWiki does not log the user out of the OpenID Connect provider.

      Steps to reproduce

      1. Configure the OIDC authenticator with a provider that has an end session (logout) endpoint
      2. Set oidc.tryLocal=false
      3. Log in through the provider
      4. Click "Log-out" in XWiki

      Result

      The XWiki logout is not detected by the authenticator, so the provider logout request is never sent. The provider session stays active and the user is immediately authenticated again, i.e. they stay logged in.

      Expected

      Same behavior as with oidc.tryLocal=true: the user is redirected to the provider logout endpoint and ends up logged out of both XWiki and the provider.

      Cause

      When the standard authenticator is disabled, the authenticator used for the request is never initialized with the login, logout and error pages configuration, so it never recognizes the logout URL.

      Attachments

        Issue Links

          Activity

            People

              tmortagne Thomas Mortagne
              tmortagne Thomas Mortagne
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: