Admin Console: OpenIddict Applications editor force-disables 'Allow end session endpoint' for public clients (logout fails with ID2052)

[JontyMin]

Summary

In the new Admin Console (modern React templates), the OpenIddict Applications edit dialog force-disables "Allow end session endpoint" for public clients. Since the Post logout redirect URIs input is only rendered when "Allow end session endpoint" is checked, it becomes impossible to configure post-logout redirect URIs for any public client (i.e. every SPA client) through the UI. Logout for such clients then always fails with:

error: invalid_request
error_description: The specified 'post_logout_redirect_uri' is invalid.
error_uri: https://documentation.openiddict.com/errors/ID2052

Public clients (SPAs using authorization code + PKCE) are exactly the clients that need the end session endpoint, and OpenIddict fully supports it for them. The template's own data seeder confirms this: seeded public clients (*_App, *_AdminConsole) are created with the end session permission and post-logout redirect URIs via CreateOrUpdateApplicationAsync.

Affected versions

• ABP 10.5.0 — embedded Admin Console in Volo.Abp.AdminConsole (layered modern React template). Verified in the shipped bundle (assets/ApplicationsPage-*.js), which contains:

  useEffect(()=>{ isPublic && ( getValues(`allowEndSessionEndpoint`) && setValue(`allowEndSessionEndpoint`, !1), ... ) }, ...)

• ABP 10.6.0 — same logic in apps/react-admin-console/src/pages/openiddict/ApplicationsPage.tsx of the modern microservice template (a useEffect that resets allowEndSessionEndpoint to false whenever clientType === 'public').

Steps to reproduce

1. Create a solution from a modern React template (e.g. abp new MyApp -t app --tiered --ui-framework react, ABP 10.5).
2. Open the Admin Console → Administration → OpenId → Applications → New application.
3. Create a Public client / Web application with authorization code flow and a redirect URI (a typical SPA client).
4. Try to enable Allow end session endpoint on the Authorization tab → the checkbox immediately resets to unchecked.
5. Note the Redirect uris tab never shows a "Post logout redirect URIs" field (it is rendered only when end session is enabled). The only visible logout-related field is "Front channel logout uri", which is easily mistaken for it but is not used to validate post_logout_redirect_uri.
6. Sign in to any app using this client, then sign out → OpenIddict rejects the end session request with ID2052.

Additional impact: silently breaks seeded clients

Because the reset runs on the edit form as well, editing any seeded public client through this UI (e.g. just adding a redirect URI to MyApp_App and saving) strips its endsession endpoint permission and post-logout redirect URIs — silently breaking logout for a previously working client.

Expected behavior

"Allow end session endpoint" should be configurable for public clients (as it is for the seeder-created clients), and the Post logout redirect URIs field should be editable for them.

Workaround

Bypass the UI and call the HTTP API directly (PUT /api/openiddict/applications/{id}) with allowEndSessionEndpoint: true and the desired postLogoutRedirectUris — the app service accepts these values without issue; only the UI blocks them.

Environment

• ABP Framework version: 10.5.0 (commercial, modern React tiered template); also reproduced against the 10.6.0 microservice template's react-admin-console source
• UI type: React (Admin Console)
• Database provider: EF Core / PostgreSQL
• Tiered: yes

(Reporting here because it affects all modern React template users; happy to move this to the support portal if that is the preferred channel for Admin Console issues.)

[maliming]

Hi,

Until the fix ships you can still set this from the UI. Open the client, wait for the dialog to finish loading, then tick Allow end session endpoint and don't touch the client type afterwards. Post logout redirect uris appears on the Redirect uris tab, and saving keeps both. On a new client, pick the client type and enable a browser flow first, then tick it.

Your existing post logout redirect uris are not lost, they are only hidden while the permission is off.

We'll fix this in the next 10.6 patch.

Thanks