Logout (clear cookie + RP-initiated) #19

New issue

Closed

opened 2026-09-14 17:04:59 +00:00 by ginjiruu · 0 comments

ginjiruu commented

2026-09-14 17:04:59 +00:00

Owner

Parent

#11 — Spec: The flow-serving bridge (gRPC ext_authz Check + OIDC/Exchange flows + callback/logout listener)

What to build

OIDC logout: a user signs out and their Session ends. By default it is local (the browser's Session is cleared) with no extra config; opt-in, it also ends the session at Kanidm (RP-initiated).

Acceptance criteria

Clears the Session cookie (Set-Cookie with Max-Age=0).
EndSession=true (opt-in) → 302 to the end_session_endpoint with id_token_hint (RP-initiated).
EndSession=false (default) → clear + 302 back (local-only, zero-config).

Blocked by

#13 — State-model amendment: resolve + carry end_session_endpoint
#14 — OIDC steady-state Check

## Parent #11 — Spec: The flow-serving bridge (gRPC ext_authz Check + OIDC/Exchange flows + callback/logout listener) ## What to build OIDC logout: a user signs out and their Session ends. By default it is local (the browser's Session is cleared) with no extra config; opt-in, it also ends the session at Kanidm (RP-initiated). ## Acceptance criteria - [ ] Clears the Session cookie (`Set-Cookie` with `Max-Age=0`). - [ ] `EndSession=true` (opt-in) → 302 to the `end_session_endpoint` with `id_token_hint` (RP-initiated). - [ ] `EndSession=false` (default) → clear + 302 back (local-only, zero-config). ## Blocked by - #13 — State-model amendment: resolve + carry `end_session_endpoint` - #14 — OIDC steady-state Check

ginjiruu added this to the Flow-serving bridge (spec #11) milestone

2026-09-14 17:05:35 +00:00

ginjiruu added the

ready-for-agent

label

2026-09-14 17:08:13 +00:00

ginjiruu referenced this issue from a pull request that will close it,

2026-09-15 04:55:33 +00:00

Logout (session cookie clear, RP-initiated end-session, 302 back) #28

ginjiruu closed this issue

2026-09-15 17:29:34 +00:00

ginjiruu referenced this issue