Skip to content

Added logout functionality through provider #190

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 2 commits into from
Closed

Added logout functionality through provider #190

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bb21ec6
Added logout functionality through provider
dlouwers-aez Jan 22, 2019
3541c12
Fix for method documentation LogoutURL
dlouwers-aez Jan 22, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 30 additions & 5 deletions oidc.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ import (
"io/ioutil"
"mime"
"net/http"
"net/url"
"strings"
"time"

Expand Down Expand Up @@ -69,6 +70,7 @@ type Provider struct {
authURL string
tokenURL string
userInfoURL string
logoutURL string

// Raw claims returned by the server.
rawClaims []byte
Expand All @@ -82,11 +84,12 @@ type cachedKeys struct {
}

type providerJSON struct {
Issuer string `json:"issuer"`
AuthURL string `json:"authorization_endpoint"`
TokenURL string `json:"token_endpoint"`
JWKSURL string `json:"jwks_uri"`
UserInfoURL string `json:"userinfo_endpoint"`
Issuer string `json:"issuer"`
AuthURL string `json:"authorization_endpoint"`
TokenURL string `json:"token_endpoint"`
JWKSURL string `json:"jwks_uri"`
UserInfoURL string `json:"userinfo_endpoint"`
EndSessionURL string `json:"end_session_endpoint"`
}

// NewProvider uses the OpenID Connect discovery mechanism to construct a Provider.
Expand Down Expand Up @@ -128,6 +131,7 @@ func NewProvider(ctx context.Context, issuer string) (*Provider, error) {
authURL: p.AuthURL,
tokenURL: p.TokenURL,
userInfoURL: p.UserInfoURL,
logoutURL: p.EndSessionURL,
rawClaims: body,
remoteKeySet: NewRemoteKeySet(ctx, p.JWKSURL),
}, nil
Expand Down Expand Up @@ -158,6 +162,27 @@ func (p *Provider) Endpoint() oauth2.Endpoint {
return oauth2.Endpoint{AuthURL: p.authURL, TokenURL: p.tokenURL}
}

// LogoutURL returns the logout endpoints for the given provider.
// See: https://openid.net/specs/openid-connect-session-1_0.html#RPLogout
func (p *Provider) LogoutURL(idTokenHint string, redirectURL string, state string) string {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Where do these values come from? E.g. how would a user get the idTokenHint and redirectURL?

Copy link
Author

@dlouwers dlouwers Apr 18, 2019 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For idTokenHint I am using the token value, which works on Azure AD OpenID Connect. The redirectURL I am getting off of the request url query parameter, but sources could differ. It must be registered as a valid callback url, just like a login url. This callback makes sure that the application session is ended and can be registered separately as a logout url in Azure so that it calls all registered logout url's when a user has signed off, effectively implementing single signoff.

In my case:

http.Redirect(w, r, openIDConfig.provider.LogoutURL(openIDTokenCookie.Value, callbackURL, redirectURL), http.StatusFound)

See: https://docs.microsoft.com/en-us/azure/active-directory/develop/v1-protocols-openid-connect-code#single-sign-out

logoutURL, err := url.Parse(p.logoutURL)
if err != nil {
return ""
}
query := logoutURL.Query()
if idTokenHint != "" {
query.Set("id_token_hint", idTokenHint)
}
if redirectURL != "" {
query.Set("post_logout_redirect_uri", redirectURL)
}
if state != "" {
query.Set("state", state)
}
logoutURL.RawQuery = query.Encode()
return logoutURL.String()
}

// UserInfo represents the OpenID Connect userinfo claims.
type UserInfo struct {
Subject string `json:"sub"`
Expand Down