[QA] no logout from identity provider possible
Open
Nobody has claimed this yet.
- Dominant language
- Kotlin
- Stars
- 4.2k
- Forks
- 3.1k
- Avg merge
- 1d 12h
- Merged PRs (30d)
- 7
Description
See with android App version ownCloud release Version 3.0.1 (5e553f078)
Actual behaviour
- I have an owncloud server that requires login via keycloak idp (using the server openidconnect app version 2.2.0-rc.1)
- Connect android app with the server, the IDP broweser window opens, I can choose a user and log in. OK

- Use the trashcan icon to delete the account again.
- Connect again (without waiting more than 10 minutes)
- The IDP immediately authorizes the app, without showing a user password dialog. BAD
- There is no way to choose a differnet user for this server. BAD.
- Wait 10 Minutes. Connect to the same server again.
- A message appears saying my token is expired, I need to log in.

- A message appears saying my token is expired, I need to log in.
- Click "Einloggen" (log in). The app refreshes, again without asking for username or password and files are now accessible for the original user.

- Note, that the expired message remains at the bottom of the screen, and upload does not work. BAD.
- have to click "Einloggen" again. After that, the message is gone and upload works. Okayish
Tell us what should happen.
- when the account is removed, it should also be logged out from the IDP, so that any remainng session tokens are invalidated.
- it should always be possible to choose the username, after entering a server URL.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the Android app flow with a server using Keycloak and the server OpenID Connect app: add an account, remove it, reconnect within 10 minutes, and retry after token expiry. Check the account-removal and login flows for IDP session handling and expired-token state. Done means removing an account invalidates the remaining IDP session, users can choose a username on reconnect, and the expired message does not block uploads after login.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, kotlin
- Domain
- authentication, mobile
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100