Support RP initiated logout

[mooreds]

Support RP initiated logout

Description

Support this spec: https://openid.net/specs/openid-connect-rpinitiated-1_0.html

I read it and I think we support everything there (the metadata, the other MUSTs) but am not sure.

So this may be a documentation issue or may require some work to support it.

Community guidelines

All issues filed in this repository must abide by the FusionAuth community guidelines.

[robotdan]

We functionally support RP initiated logout, and front channel logout.

• https://openid.net/specs/openid-connect-rpinitiated-1_0.html
• https://openid.net/specs/openid-connect-frontchannel-1_0.html

Perhaps we need to make our doc clearer, and review these specifications to see if we are missing any MUSTs, and review all of the optional parts to verify it is as complete as we'd like it to be.

[mooreds]

Haven't reviewed this yet, but our docs on front channel logout are pretty extensive: https://fusionauth.io/docs/lifecycle/authenticate-users/oauth/endpoints#logout

[robotdan]

We do publish end_session_endpoint via the /.well-known/openid-configuration endpoint. Does that not satisify RP initiated logout?

Section 2.1 https://openid.net/specs/openid-connect-rpinitiated-1_0.html#OPMetadata

This OpenID Provider Metadata parameter MUST be included in the Server's discovery responses when RP-Initiated Logout and Discovery are supported:

end_session_endpoint
REQUIRED. URL at the OP to which an RP can perform a redirect to request that the End-User be logged out at the OP. This URL MUST use the https scheme and MAY contain port, path, and query parameter components.

[mooreds]

I think there are some additional MUSTs that we need to do or at least confirm.

Here's my list:

OpenID Providers MUST support the use of the HTTP GET and POST methods defined in RFC 7231 [RFC7231] at the Logout Endpoint. RPs MAY use the HTTP GET or POST methods to send the logout request to the OP. If using the HTTP GET method, the request parameters are serialized using URI Query String Serialization. If using the HTTP POST method, the request parameters are serialized using Form Serialization.

We support this.

When both client_id and id_token_hint are present, the OP MUST verify that the Client Identifier matches the one used when issuing the ID Token.

I don't know if we do that.

The [post_logout_redirect_uri value] MUST have been previously registered with the OP, either using the post_logout_redirect_uris Registration parameter or via another mechanism.

We do this.

When an id_token_hint parameter is present, the OP MUST validate that it was the issuer of the ID Token.

I don't know if we do this.

At the Logout Endpoint, the OP SHOULD ask the End-User whether to log out of the OP as well. Furthermore, the OP MUST ask the End-User this question if an id_token_hint was not provided or if the supplied ID Token does not belong to the current OP session with the RP and/or currently logged in End-User. If the End-User says "yes", then the OP MUST log out the End-User.

We don't, as far as I know, ever ask if the user wants to log out of the OP endpoint, we always do that.

This OpenID Provider Metadata parameter MUST be included in the Server's discovery responses when RP-Initiated Logout and Discovery are supported

As @robotdan points out, we do that, we just don't clearly document it.

[The end session] URL MUST use the https scheme and MAY contain port, path, and query parameter components.

Not sure we are complying entirely here, because you can run FusionAuth under http locally. But that's probably splitting hairs.

In some cases, the RP will request that the End-User's User Agent to be redirected back to the RP after a logout has been performed. Post-logout redirection is only done when the logout is RP-initiated, in which case the redirection target is the post_logout_redirect_uri parameter value sent by the initiating RP. An id_token_hint carring an ID Token for the RP is also RECOMMENDED when requesting post-logout redirection; if it is not supplied with post_logout_redirect_uri, the OP MUST NOT perform post-logout redirection unless the OP has other means of confirming the legitimacy of the post-logout redirection target. The OP also MUST NOT perform post-logout redirection if the post_logout_redirect_uri value supplied does not exactly match one of the previously registered post_logout_redirect_uris values. The post-logout redirection is performed after the OP has finished notifying the RPs that logged in with the OP for that End-User that they are to log out the End-User.

I think we meet this, because we perform post-logout redirection based on previously configured logout URL values.

If any of the validation procedures defined in this specification fail, any operations requiring the information that failed to correctly validate MUST be aborted and the information that failed to validate MUST NOT be used.

I think we do this.