mirror of
https://github.com/zitadel/zitadel.git
synced 2025-08-11 20:57:31 +00:00
fix(OIDC): back channel logout work for custom UI (#9487)
# Which Problems Are Solved When using a custom / new login UI and an OIDC application with registered BackChannelLogoutUI, no logout requests were sent to the URI when the user signed out. Additionally, as described in #9427, an error was logged: `level=error msg="event of type *session.TerminateEvent doesn't implement OriginEvent" caller="/home/runner/work/zitadel/zitadel/internal/notification/handlers/origin.go:24"` # How the Problems Are Solved - Properly pass `TriggerOrigin` information to session.TerminateEvent creation and implement `OriginEvent` interface. - Implemented `RegisterLogout` in `CreateOIDCSessionFromAuthRequest` and `CreateOIDCSessionFromDeviceAuth`, both used when interacting with the OIDC v2 API. - Both functions now receive the `BackChannelLogoutURI` of the client from the OIDC layer. # Additional Changes None # Additional Context - closes #9427
This commit is contained in:
@@ -568,6 +568,7 @@ func (s *Server) CreateTokenCallbackURL(ctx context.Context, req op.AuthRequest)
|
||||
req.GetID(),
|
||||
implicitFlowComplianceChecker(),
|
||||
slices.Contains(client.GrantTypes(), oidc.GrantTypeRefreshToken),
|
||||
client.client.BackChannelLogoutURI,
|
||||
)
|
||||
if err != nil {
|
||||
return "", err
|
||||
|
@@ -41,6 +41,7 @@ func (s *Server) CodeExchange(ctx context.Context, r *op.ClientRequest[oidc.Acce
|
||||
plainCode,
|
||||
codeExchangeComplianceChecker(client, r.Data),
|
||||
slices.Contains(client.GrantTypes(), oidc.GrantTypeRefreshToken),
|
||||
client.client.BackChannelLogoutURI,
|
||||
)
|
||||
} else {
|
||||
session, err = s.codeExchangeV1(ctx, client, r.Data, r.Data.Code)
|
||||
|
@@ -25,7 +25,7 @@ func (s *Server) DeviceToken(ctx context.Context, r *op.ClientRequest[oidc.Devic
|
||||
if !ok {
|
||||
return nil, zerrors.ThrowInternal(nil, "OIDC-Ae2ph", "Error.Internal")
|
||||
}
|
||||
session, err := s.command.CreateOIDCSessionFromDeviceAuth(ctx, r.Data.DeviceCode)
|
||||
session, err := s.command.CreateOIDCSessionFromDeviceAuth(ctx, r.Data.DeviceCode, client.client.BackChannelLogoutURI)
|
||||
if err == nil {
|
||||
return response(s.accessTokenResponseFromSession(ctx, client, session, "", client.client.ProjectID, client.client.ProjectRoleAssertion, client.client.AccessTokenRoleAssertion, client.client.IDTokenRoleAssertion, client.client.IDTokenUserinfoAssertion))
|
||||
}
|
||||
|
Reference in New Issue
Block a user