goauthentik / goauthentik/authentik
Honor upstream OIDC back-channel logout and kill the local session
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 644
Description
## What
authentik as OAuth2/OIDC relying party must accept back-channel logout from the upstream OP and kill the local session.
## Want
- Authentik as OAuth2/OIDC relying party must accept back-channel logout from the upstream OP
- Kill the local session
## Ideas this came from
- [#16484 Backchannel Logout for OAuth2 source](https://github.com/goauthentik/authentik/issues/16484) — I have a setup with multiple authentik instances with are connected over federations. When logging out from the main instances the session in the other instance
- [#19707 Can/Could Authentik serve as a Relying Party (RP) and receive Back Channel Logouts?](https://github.com/goauthentik/authentik/issues/19707) — Is your feature request related to a problem? I have an OpenID OIDC provider that Authentik is properly validating users against. My issue is invalidating the A
Contributor guide
Research direction
No files or tests are identified in the issue. Start by locating the OAuth2/OIDC relying-party logout handling and determine how upstream back-channel logout can identify and invalidate the local session; done means authentik accepts the upstream logout and the corresponding local session is killed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authentication
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100