goauthentik / goauthentik/authentik

Honor upstream OIDC back-channel logout and kill the local session

Open
#25,283 0 comments 0 reactions 0 assignees View on GitHub
enhancement enhancement/confirmed
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 1h
Merged PRs (30d)
644

Description

## What

authentik as OAuth2/OIDC relying party must accept back-channel logout from the upstream OP and kill the local session.

## Want

- Authentik as OAuth2/OIDC relying party must accept back-channel logout from the upstream OP
- Kill the local session

## Ideas this came from

- [#16484 Backchannel Logout for OAuth2 source](https://github.com/goauthentik/authentik/issues/16484) — I have a setup with multiple authentik instances with are connected over federations. When logging out from the main instances the session in the other instance
- [#19707 Can/Could Authentik serve as a Relying Party (RP) and receive Back Channel Logouts?](https://github.com/goauthentik/authentik/issues/19707) — Is your feature request related to a problem? I have an OpenID OIDC provider that Authentik is properly validating users against. My issue is invalidating the A

Contributor guide

Open the contributing guide

Research direction

No files or tests are identified in the issue. Start by locating the OAuth2/OIDC relying-party logout handling and determine how upstream back-channel logout can identify and invalidate the local session; done means authentik accepts the upstream logout and the corresponding local session is killed.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
authentication
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.