DependencyTrack / DependencyTrack/dependency-track

Logout of OIDC session shall implement OIDC logout

Open
#2,015 0 comments 5 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior:

- User connects through OIDC
- User disconnect using `logout` feature from DT
- DT token gets dropped and user is redirected to login screen

-> User can reconnect through OIDC through a single clic without having to provide any credentials

Reason: SSO token remains and neither backend nor auth server are notified of the logout attempt

### Proposed Behavior:

- Implement OpenID logout, see [OpenID Connect RP-Initiated Logout 1.0](https://openid.net/specs/openid-connect-rpinitiated-1_0.html)

Contributor guide

Open the contributing guide

Research direction

Start by locating the existing logout feature and OIDC integration, then read the OpenID Connect RP-Initiated Logout 1.0 specification linked in the issue. Trace what happens when an OIDC user logs out and identify the backend and authentication-server interactions needed. Done means logout follows the OIDC flow rather than only dropping the DT token, preventing silent reconnection without credentials.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authentication, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.