DependencyTrack / DependencyTrack/dependency-track
Logout of OIDC session shall implement OIDC logout
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior:
- User connects through OIDC
- User disconnect using `logout` feature from DT
- DT token gets dropped and user is redirected to login screen
-> User can reconnect through OIDC through a single clic without having to provide any credentials
Reason: SSO token remains and neither backend nor auth server are notified of the logout attempt
### Proposed Behavior:
- Implement OpenID logout, see [OpenID Connect RP-Initiated Logout 1.0](https://openid.net/specs/openid-connect-rpinitiated-1_0.html)
Contributor guide
Research direction
Start by locating the existing logout feature and OIDC integration, then read the OpenID Connect RP-Initiated Logout 1.0 specification linked in the issue. Trace what happens when an OIDC user logs out and identify the backend and authentication-server interactions needed. Done means logout follows the OIDC flow rather than only dropping the DT token, preventing silent reconnection without credentials.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100