postalserver / postalserver/postal

Missing OIDC Logout Support — Postal cannot perform SSO logout (Keycloak/OIDC)

Open
#3,490 0 comments 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
Ruby
Stars
16.8k
Forks
1.3k
Avg merge
13d 7h
Merged PRs (30d)
2

Description

### Summary

Postal supports OpenID Connect login, but **there is no implementation for OIDC logout**.

After reviewing the official documentation, the config file, and the Postal source code,
there is **no option** related to:

- OIDC logout
- end_session_endpoint
- post_logout_redirect_uri
- id_token_hint
- global SSO logout

As a result, Postal logs the user out **locally only**, and does not end the session at the Identity Provider (Keycloak in my case).

### Impact

Users who click "Logout" in Postal:

- remain logged in on the identity provider (Keycloak),
- can immediately re-login without entering credentials,
- cannot terminate their SSO session,
- experience broken/partial SSO behavior.

This is a security and UX problem for all OIDC setups.

### Expected behavior

Postal should support **OIDC RP-Initiated Logout** by:

1. Reading the `end_session_endpoint` from OIDC discovery.
2. Redirecting users to:

end_session_endpoint?post_logout_redirect_uri=…&id_token_hint=…

3. Allowing configuration such as:

oidc:
rp_logout_enabled: true
post_logout_redirect_uri: https://postal.xxxxxx.com

### Why this matters

- All major IdPs (Keycloak, Azure AD, Auth0, Okta, Google) rely on RP-Initiated Logout.
- Postal cannot be properly integrated into enterprise SSO without this.
- Session security and compliance require full logout across all apps.

### Environment

- Postal version: latest / master
- Deployment: Kubernetes + OIDC (Keycloak)
- OIDC Provider: Keycloak 24+

### Request

Please add OIDC logout support (RP-Initiated Logout).
I can help test any PR or development build.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.