Details
-
Bug
-
Resolution: Fixed
-
Major
-
2.24.0
-
None
-
Unit, Integration
-
Unknown
-
Description
When the standard authenticator is disabled (oidc.tryLocal=false in xwiki.properties, or "Is standard authenticator allowed?" unchecked in the client configuration), logging out of XWiki does not log the user out of the OpenID Connect provider.
Steps to reproduce
- Configure the OIDC authenticator with a provider that has an end session (logout) endpoint
- Set oidc.tryLocal=false
- Log in through the provider
- Click "Log-out" in XWiki
Result
The XWiki logout is not detected by the authenticator, so the provider logout request is never sent. The provider session stays active and the user is immediately authenticated again, i.e. they stay logged in.
Expected
Same behavior as with oidc.tryLocal=true: the user is redirected to the provider logout endpoint and ends up logged out of both XWiki and the provider.
Cause
When the standard authenticator is disabled, the authenticator used for the request is never initialized with the login, logout and error pages configuration, so it never recognizes the logout URL.
Attachments
Issue Links
- relates to
-
OIDC-295 Add the possibility to block any access to the standard authenticator
-
- Closed
-