Cannot logout with Azure OAuth

[onght]

I followed the instruction in the user guide section 26.3 to setup Azure OAuth for authentication to Meshcentral. The login works perfectly but I am having problem logging out. After clicking "Logout" from Meshcentral, the UI goes back to the login page but when I click on the Azure single sign-on button, it will immediately log me in again. Is there anything that I missed? Thanks in advance.

[si458]

Plz do not use the userguide pdf as its out of date and stuff might not work.
Instead plz use the new docs instead https://ylianst.github.io/MeshCentral/ and look at the openidauthstrategies section instead

[onght]

I am following the instruction from the latest guide from that link. I can login with the logout doesn't work. Any suggestion? Thanks.

[si458]

Sadly, without a test azure environment, I can not really help fix the issue

I don't use Azure/Microsoft/365 in any way

If u are happy, email me with some credentials/test keys etc and i can have a proper look into it for you!(check my profile page or use my donate link and leave a comment and I will reply to ur email)

[onght]

I found out how to get the logout to work. Add the logout url in the "authStrategies" section. Below is a sample:

  "domains": {
    "": {
	"Title": "Meshcentral Test Server.",
	"NewAccounts": false,
	"authStrategies": {
            "azure": {
		  "newAccounts": true,
		  "clientid": "3sxxsssd-fa07-4f8d-a6fd-4xfdsdsef",
		  "clientsecret": "2S*HD~IXSHD&CD3-5XXXXXXX4ac_5jYTSDZ",
		  "tenantid": "caabcdsf2-744a-465y-b543-3helloworld6",
		  "logouturl": "https://www.office.com/estslogout?"
		}
	    }
      }
  },

[si458]

ive just re-read ur message, when you click logout, it will log you out from meshcentral NOT your azure because its single sign on,
so oversally when you then click the azure sign in button again, it will take you to the azure login page which in turn would take you straight to meshcentral because you are still logged in to azure!
this is by design

[si458]

just realised azure offer a free entra id because i have my hotmail account linked to azure, so ive been able to do a bit of testing

indeed when u logout it takes u to the meshcentral login page, and clicking the azure login logs in again, but this is expected

i also found out you can use "logouturl": "https://login.microsoftonline.com/common/oauth2/logout"
which will log you out of your azure account and stay on the azure logout screen
BUT ALSO
you can use https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https://meshcentral.myserver.com/login to redirect after azure logout back to meshcentral or a different url !

the logout url is autopopulated if you use OIDC with azure rather than the azure option which uses a different package which DOESNT include a signout url so doesnt sign you out

[olivluca]

@si458 Is there a way to avoid completely the post_logout_redirect_uri?
I tried both

         "client": {
            "post_logout_redirect_uri": false
          },  

and

         "client": {
            "post_logout_redirect_uri": ""
          },  

but then it will use the default value (?post_logout_redirect_uri=https://mesh.dom.ain/login).

I know that meshcentral is using that config option, because if I use

         "client": {
            "post_logout_redirect_uri": "pippo"
          },  

pippo is what I get in the post_logout_redirect_uri

My problem is that with the ?post_logout_redirect_uri appended my oidc server (lemonldap) gives an "unauthorized url" error, if I manually remove it from the url it then offers me the option to logout (i.e the autodiscovered logouturl works fine).

[si458]

@olivluca yes this will be fully supported in the next release of meshcentral!
i added this feature in literally a week ago 587973e

edit: you can also try applying the patch i just gave u manually and restarting your server and seeing if it works!

[olivluca]

Good to know, thank you. I'll way for the release (I'm running meshcentral in a docker container and I see there's no "patch" installed, though maybe I can install it just to test this feature).

Edit: I patched webserver.js inside the container and it works (with "post_logout_redirect_uri": false).

[si458]

oh docker makes it even easier! ghcr.io/ylianst/meshcentral:master <- master branch code built ever day at 3AM :)
if it dont work just revert to latest 👍

edit: glad it also worked too! 👍