Oidc Backchannel logout Uri

[poweriton]

Describe the bug

I am configuring the oauth2 management addon to authenticate users based on keycloak in this instance. I wanted to implement a backchannel/front channel logout but I can't find any information on the endpoints to use.

Reproduction steps

1. Configure Oauth 2 plugin
2. Login works OK
3. Reject session from IDP/logout
4. Refresh client browser
5. Client still has access
6. token expires, client sees Not_Authorized

Expected behavior

1. Configure Oauth 2 plugin
2. Login works OK
3. Reject session from IDP/logout
4. client sees Not_Authorized

Additional context

No response

[michaelklishin]

I don't think such "IP-initiated revocation" is supported for granted tokens. This will not be a priority, including specifically for all the work related to OAuth 2, OIDC, and so on, for the foreseeable future.

[michaelklishin]

For management UI access, this may end up being a relatively small amount of work, depending on how common such feature/callback is for various identity providers.

For established client connections, this is significantly more involved, and is basically the same fundamental design challenge/set of trade-offs as in #8293.

[poweriton]

My specific use case is just the UI, as its exposed. My other connections are behind the proxy so don't post much of a risk

[poweriton]

For completeness, here is the specification

https://openid.net/specs/openid-connect-backchannel-1_0.html#BCRegistration

[MarcialRosales]

Hi @poweriton , we are going to support front-channel logout. Back-channel logout does not make sense in RabbitMQ as all the user's state is maintained solely in the browser.
Here is the feature request : #8544