mirror of
https://github.com/zitadel/zitadel.git
synced 2024-12-13 19:44:21 +00:00
041af26917
# Which Problems Are Solved Currently ZITADEL supports RP-initiated logout for clients. Back-channel logout ensures that user sessions are terminated across all connected applications, even if the user closes their browser or loses connectivity providing a more secure alternative for certain use cases. # How the Problems Are Solved If the feature is activated and the client used for the authentication has a back_channel_logout_uri configured, a `session_logout.back_channel` will be registered. Once a user terminates their session, a (notification) handler will send a SET (form POST) to the registered uri containing a logout_token (with the user's ID and session ID). - A new feature "back_channel_logout" is added on system and instance level - A `back_channel_logout_uri` can be managed on OIDC applications - Added a `session_logout` aggregate to register and inform about sent `back_channel` notifications - Added a `SecurityEventToken` channel and `Form`message type in the notification handlers - Added `TriggeredAtOrigin` fields to `HumanSignedOut` and `TerminateSession` events for notification handling - Exported various functions and types in the `oidc` package to be able to reuse for token signing in the back_channel notifier. - To prevent that current existing session termination events will be handled, a setup step is added to set the `current_states` for the `projections.notifications_back_channel_logout` to the current position - [x] requires https://github.com/zitadel/oidc/pull/671 # Additional Changes - Updated all OTEL dependencies to v1.29.0, since OIDC already updated some of them to that version. - Single Session Termination feature is correctly checked (fixed feature mapping) # Additional Context - closes https://github.com/zitadel/zitadel/issues/8467 - TODO: - Documentation - UI to be done: https://github.com/zitadel/zitadel/issues/8469 --------- Co-authored-by: Hidde Wieringa <hidde@hiddewieringa.nl>
119 lines
3.1 KiB
Go
119 lines
3.1 KiB
Go
package notification
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/zitadel/logging"
|
|
|
|
"github.com/zitadel/zitadel/internal/notification/channels/email"
|
|
"github.com/zitadel/zitadel/internal/notification/channels/set"
|
|
"github.com/zitadel/zitadel/internal/notification/channels/sms"
|
|
"github.com/zitadel/zitadel/internal/notification/channels/webhook"
|
|
"github.com/zitadel/zitadel/internal/notification/handlers"
|
|
"github.com/zitadel/zitadel/internal/notification/senders"
|
|
"github.com/zitadel/zitadel/internal/notification/types"
|
|
"github.com/zitadel/zitadel/internal/telemetry/metrics"
|
|
)
|
|
|
|
var _ types.ChannelChains = (*channels)(nil)
|
|
|
|
type counters struct {
|
|
success deliveryMetrics
|
|
failed deliveryMetrics
|
|
}
|
|
|
|
type deliveryMetrics struct {
|
|
email string
|
|
sms string
|
|
json string
|
|
}
|
|
|
|
type channels struct {
|
|
q *handlers.NotificationQueries
|
|
counters counters
|
|
}
|
|
|
|
func newChannels(q *handlers.NotificationQueries) *channels {
|
|
c := &channels{
|
|
q: q,
|
|
counters: counters{
|
|
success: deliveryMetrics{
|
|
email: "successful_deliveries_email",
|
|
sms: "successful_deliveries_sms",
|
|
json: "successful_deliveries_json",
|
|
},
|
|
failed: deliveryMetrics{
|
|
email: "failed_deliveries_email",
|
|
sms: "failed_deliveries_sms",
|
|
json: "failed_deliveries_json",
|
|
},
|
|
},
|
|
}
|
|
registerCounter(c.counters.success.email, "Successfully delivered emails")
|
|
registerCounter(c.counters.failed.email, "Failed email deliveries")
|
|
registerCounter(c.counters.success.sms, "Successfully delivered SMS")
|
|
registerCounter(c.counters.failed.sms, "Failed SMS deliveries")
|
|
registerCounter(c.counters.success.json, "Successfully delivered JSON messages")
|
|
registerCounter(c.counters.failed.json, "Failed JSON message deliveries")
|
|
return c
|
|
}
|
|
|
|
func registerCounter(counter, desc string) {
|
|
err := metrics.RegisterCounter(counter, desc)
|
|
logging.WithFields("metric", counter).OnError(err).Panic("unable to register counter")
|
|
}
|
|
|
|
func (c *channels) Email(ctx context.Context) (*senders.Chain, *email.Config, error) {
|
|
emailCfg, err := c.q.GetActiveEmailConfig(ctx)
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
chain, err := senders.EmailChannels(
|
|
ctx,
|
|
emailCfg,
|
|
c.q.GetFileSystemProvider,
|
|
c.q.GetLogProvider,
|
|
c.counters.success.email,
|
|
c.counters.failed.email,
|
|
)
|
|
return chain, emailCfg, err
|
|
}
|
|
|
|
func (c *channels) SMS(ctx context.Context) (*senders.Chain, *sms.Config, error) {
|
|
smsCfg, err := c.q.GetActiveSMSConfig(ctx)
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
chain, err := senders.SMSChannels(
|
|
ctx,
|
|
smsCfg,
|
|
c.q.GetFileSystemProvider,
|
|
c.q.GetLogProvider,
|
|
c.counters.success.sms,
|
|
c.counters.failed.sms,
|
|
)
|
|
return chain, smsCfg, err
|
|
}
|
|
|
|
func (c *channels) Webhook(ctx context.Context, cfg webhook.Config) (*senders.Chain, error) {
|
|
return senders.WebhookChannels(
|
|
ctx,
|
|
cfg,
|
|
c.q.GetFileSystemProvider,
|
|
c.q.GetLogProvider,
|
|
c.counters.success.json,
|
|
c.counters.failed.json,
|
|
)
|
|
}
|
|
|
|
func (c *channels) SecurityTokenEvent(ctx context.Context, cfg set.Config) (*senders.Chain, error) {
|
|
return senders.SecurityEventTokenChannels(
|
|
ctx,
|
|
cfg,
|
|
c.q.GetFileSystemProvider,
|
|
c.q.GetLogProvider,
|
|
c.counters.success.json,
|
|
c.counters.failed.json,
|
|
)
|
|
}
|