Current Behavior
I understand that the openid-connect plugin does not have support for back-channel logout... our service behind the plugin does support this and knows when a user logs out or token is revoked.
Right now we have requests going through a route configured with the plugin. Authentication happens normally, the user is redirected to the IDP and then the session is created with a cookie and everything works.
The problem is after the user logs out by other means. Our backend server gets notified of the logout and considers the users access token invalid.
When a request happens again through the route with the plugin, we return a 401 from the backend server and the 401 is returned through the route instead of the openid-connect plugin trying to acquire a new token.
This is noticeable when the user logs back in, the route is broken for them until the access token it had eventually expires.
Or when the user logs in as someone else, the same thing happens.
Expected Behavior
We expect the openid-connect plugin to try to get a new access token if the token it has results in a 401 where it is being used.
Error Logs
No response
Steps to Reproduce
- configure route with openid-connect plugin
- log in user with credentials through route
- invalidate the token through other means (re-log in, or log in as new user)
- try to access through route again
Environment
apisix version 3.17.0
Current Behavior
I understand that the openid-connect plugin does not have support for back-channel logout... our service behind the plugin does support this and knows when a user logs out or token is revoked.
Right now we have requests going through a route configured with the plugin. Authentication happens normally, the user is redirected to the IDP and then the session is created with a cookie and everything works.
The problem is after the user logs out by other means. Our backend server gets notified of the logout and considers the users access token invalid.
When a request happens again through the route with the plugin, we return a 401 from the backend server and the 401 is returned through the route instead of the openid-connect plugin trying to acquire a new token.
This is noticeable when the user logs back in, the route is broken for them until the access token it had eventually expires.
Or when the user logs in as someone else, the same thing happens.
Expected Behavior
We expect the openid-connect plugin to try to get a new access token if the token it has results in a 401 where it is being used.
Error Logs
No response
Steps to Reproduce
Environment
apisix version 3.17.0