OpenID Connect logout — Versola Docs
VersolaVersola/docs
Pre-1.00.7.1versola.kzGitHub
RUEN

OpenID Connect logout

RP-Initiated, Front-Channel and Back-Channel Logout — what Versola implements and how each notification is delivered.

Specifications: RP-Initiated Logout 1.0, Front-Channel Logout 1.0, Back-Channel Logout 1.0

These three specifications let a relying party end a user’s session at the OpenID Provider and let the provider tell the other clients of that session. Versola serves them from auth at /logout, and edge consumes both notifications.

Status

Implemented. Checked claims: 16 of 18.

RP-Initiated Logout

  • GET /logout and POST /logout; end_session_endpoint is in the default discovery document
  • id_token_hint identifies the session; an expired ID token is accepted
  • A request with the session cookie and no hint shows a confirmation page protected by a CSRF token
  • A hint that does not match the session of the cookie logs nobody out
  • post_logout_redirect_uri must exactly match one registered for the tenant, and is dropped when there is no session or hint to validate it against
  • state is returned on the post-logout redirect
  • ui_locales selects the language of the confirmation page
  • logout_hint — not implemented

Front-Channel Logout

  • frontchannel_logout_uri registered per client; the logout page loads it in an iframe
  • iss and sid are appended to the URI
  • frontchannel_logout_supported and frontchannel_logout_session_supported in the default discovery document
  • Honouring frontchannel_logout_session_required: false — the session parameters are always sent

Back-Channel Logout

  • backchannel_logout_uri registered per client; the logout token is posted as logout_token
  • Logout token with iss, aud, iat, exp, jti, sub, sid and the http://schemas.openid.net/event/backchannel-logout event, signed with the tenant’s key
  • Clients that share one endpoint receive one delivery, with all their identifiers in aud
  • Deliveries go through an outbox with retries, so a slow or unreachable client does not delay the user’s logout
  • A user-wide event carries sub and toe without sid
  • backchannel_logout_supported and backchannel_logout_session_supported in the default discovery document

Notes

  • edge reads its logout notification from the same event and ends the matching sessions; see Edge.
  • Access-token revocation uses a separate event on the same back channel; see RFC 7009.
  • The discovery flags above come from the stored discovery document, which the operator can edit; they are not derived from client settings.

Where to look

The OpenAPI reference lists the logout specification, and Edge explains how edge handles the notifications.