Support receiving OpenID Connect Back-Channel Logout notifications #4743
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
sandhose
force-pushed
the
quenting/backchannel-logout/record-id-token-claims
branch
from
e35cf0e to
8275fe9
Compare
Deploying matrix-authentication-service-docs with
|
| Latest commit: |
3bc3db1
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://c20be523.matrix-authentication-service-docs.pages.dev |
| Branch Preview URL: | https://quenting-backchannel-logout.matrix-authentication-service-docs.pages.dev |
sandhose
force-pushed
the
quenting/backchannel-logout/record-id-token-claims
branch
2 times, most recently
from
4aa593f to
0e5c964
Compare
sandhose
changed the title
sandhose
added
A-Upstream-OAuth
We don't yet do anything with them, other than logging them
Instead of having to load all authentication sessions in memory, we allow composing browser session filters with a upstream auth sessions filter
sandhose
force-pushed
the
quenting/backchannel-logout/record-id-token-claims
branch
from
fa123aa to
3bc3db1
Compare
reivilibre
approved these changes
Jul 7, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #2090
This adds support for receiving OpenID Connect Back-Channel Logout notifications. Those are fired when a user signs out from their upstream provider
This can be reviewed commit by commit. Note that we're now saving the ID token claims as a JSON field in the database. We could choose to backfill those if we wanted to make this work retroactively on previous sessions, but we don't really have nice primitives to do this kind of backfilling.
How to test this:
<kc>/realms/<realm>/account/)on_backchannel_logoutsetting on the provider