[OIDC] Session Management and Logout #1064

New issue

Open

opened 2024-07-21 12:44:07 +02:00 by nik · 8 comments

nik commented 2024-07-21 12:44:07 +02:00

Owner

Copy link

Currently, AlekSIS as an OIDC Provider does not provide sufficient security regarding logouts. Relying Parties currently suggest to the user that they were logged out, while they are never actually logged out from AlekSIS, so subsequent logins to any connected platform will succeed without credentials.

AlekSIS should hence support the following OIDC features, if possible by implementing them in django-oauth-toolkit:

• RP-Initiated Logout
• OIDC Session Management
• Front-Channel Logout or Back-Channel Logout

It might be possible that not all of these specs are required, or using only one makes more sense.

Currently, AlekSIS as an OIDC Provider does not provide sufficient security regarding logouts. Relying Parties currently suggest to the user that they were logged out, while they are never actually logged out from AlekSIS, so subsequent logins to any connected platform will succeed without credentials. AlekSIS should hence support the following OIDC features, if possible by implementing them in django-oauth-toolkit: - [x] [RP-Initiated Logout](https://openid.net/specs/openid-connect-rpinitiated-1_0.html) - [ ] [OIDC Session Management](https://openid.net/specs/openid-connect-session-1_0.html) - [ ] [Front-Channel Logout](https://openid.net/specs/openid-connect-frontchannel-1_0.html) or [Back-Channel Logout](https://openid.net/specs/openid-connect-backchannel-1_0.html) It might be possible that not all of these specs are required, or using only one makes more sense.

nik commented 2024-07-24 12:48:36 +02:00

Author

Owner

Copy link

mentioned in merge request !3195

mentioned in merge request !3195

nik commented 2024-07-24 12:48:41 +02:00

Author

Owner

Copy link

marked the checklist item RP-Initiated Logout as completed

marked the checklist item **[RP-Initiated Logout](https://openid.net/specs/openid-connect-rpinitiated-1_0.html)** as completed

nik commented 2024-07-24 12:48:53 +02:00

Author

Owner

Copy link

changed the description

changed the description

hansegucker commented 2025-07-31 18:07:40 +02:00

Owner

Copy link

marked this issue as related to #1340

marked this issue as related to #1340

magicfelix commented 2026-02-03 20:55:25 +01:00

Member

Copy link

created branch 1064-backchannel-logout to address this issue

created branch [`1064-backchannel-logout`](/AlekSIS/official/AlekSIS-Core/-/compare/master...1064-backchannel-logout) to address this issue

magicfelix commented 2026-02-03 20:55:42 +01:00

Member

Copy link

mentioned in merge request !3787

mentioned in merge request !3787

nik commented 2026-02-05 12:17:37 +01:00

Author

Owner

Copy link

mentioned in issue #1340

mentioned in issue #1340

nik commented 2026-03-04 22:28:48 +01:00

Author

Owner

Copy link

assigned to @magicfelix

assigned to @magicfelix

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

master

3960-extend-slideiterator

1625-migrate-to-vuetify-4

remove-vite-legacy-plugin

weblate-frontend

weblate

renovate/selenium-4.x

1644-dahsboard-widget-creation-broken

renovate/node-26.x

renovate/django-health-check-4.x

renovate/django-countries-9.x

1643-calendar-dashboardwidgets-throw-500er-error

renovate/django-dbbackup-5.x

1064-backchannel-logout

sis2-with-sl

fix/adapt-some-urls

1533-notifications-reminders-for-events-todos

1294-expose-free-busy-state-in-ui-for-personal-events

1303-correctly-implement-recurring-todos-with-amends-recurrence-id

1345-introduce-annotate-methods-for-more-person-related-rules

1603-search-index-is-deleted-on-cache-flush

1068-oidc-rp-initiated-registration

1065-oidc-device-code-grant-flow

1599-vite-build-fails-with-too-many-apps

fix/sort-models

1066-oidc-dynamic-client-registration

tmp-ticdesk-dev

ticdesk-search-map

cherry-pick-2b8d2e01

643-one-time-login-links

1461-birthday-calendar-oom

tmp-ticdesk-related-names-for-paweljong

1459-manifest-json-not-found

integrate-disable-into-usecrud

update-container-image-base-to-trixie

check/update-pyproject-toml

check/update-builddeps-package-json

check/update-prettier-ignore

1445-todo-list-broken

1364-track-date-of-beginning-and-end-of-group-membership

1259-generalise-places

use-object-form-reactivity

1435-cruddaylist-does-not-detect-changes-in-existing-intervals

tmp-ticdesk

stable/4.0.0

1366-frontend-for-creating-and-modifying-generic-personrelationships

master-without-vue-3

1376-expand-row-feature-of-v-data-table-doesn-t-work-when-items-include-date-time-objects

release/4.1.0.dev2

1372-fix-import-of-crudlist

1353-adapt-chipselectfield

check/update-eslint-rc-js

check/update-tox-ini

improve-selenium-startup

1268-add-specific-availability-planning-frontend

1343-fix-person-related-permissions

newer-and-rebased-migrate-crud-to-vue-3-and-generalize

1314-fix-handling-of-end-datetime-in-calendar-events-query

migrate-to-uv

tmp-ticdesk-4-0

fix-inline-crud-list-is-create

tmp-split-calendar-event-dialog

release/4.1.0

1260-refactor-account-registration-form-and-generalize-parts-of-it

add-datacheck-fix-in-changelog

1232-group-calendars

1251-registryobjects-are-their-own-parent-registries

1209-introduce-django-rest-framework-serializers

1162-strange-behaviour-with-personal-events

revert-7fe8b8b1

check/delete-eslint-rc-js

check/update-gitignore

stable-3.2

stable-3.1

update/eslint

1158-add-sorting-functionality-to-get_single_events

1055-introduce-sub-school-terms

1082-colorfield-sometimes-returns-8-digit-alpha-color-hex-code

test-build

emit-extracted-items-from-save-event

886-prevent-graphql-query-mutation-name-collisions

release/3.2.1

1038-make-dialogobjectform-send-a-diff-on-edit-instead-of-the-whole-object

release/3.1.6

fix/counter-chip

1021-allow-matching-of-social-accounts-to-local-accounts-by-email

991-set-title-attribute-for-all-unclear-frontend-spots

update-docs-without-release-distribution

850-do-not-restart-vite-serve-on-every-uwsgi-reload

991-use-tooltips-for-all-unclear-frontend-spots

983-add-groups-by-person-query

826-otp-token-emails-don-t-contain-anything-besides-the-token

781-error-if-creating-a-new-school-term-without-a-start-and-end-date

966-allow-setting-of-custom-queryset-when-creating-calendar-feeds

tmp-for-add-simple-course-book-list

release/3.2.0

868-introduce-uuid-field-for-extensiblemodel

958-introduce-parent-model-resource

954-evaluate-strawberry-and-strawberry-django

948-error-handling-with-personal-event-creation-is-not-usable

fix-custom-events-fss

923-introduce-vue-styleguidist

899-move-person-type-fields-into-constant

892-remove-model-extension-api

manage-holidays

831-data-management-for-the-model-room

fix/oauth-toolkit-migration

release-3.0

stable-2.12

819-fix-some-minor-issues-in-graphql-queries

fix-container-image

stable-2.11

stable-2.10

stable-2.13

806-expose-string-representation-of-models-via-graphql-api

800-move-generic-components-from-aleksis-app-plank-to-core

debug-foo

oidc-docs

migrate-to-vue3

789-remove-syncable-fields

remove/ical-feed

194-enable-async-framework-channels

726-dynamically-build-vue-forms

766-selfclosing-components-in-vue_base-html-break-the-page

492-follow-up-view_persons_rule-not-usable-due-to-use-of-queryset_rules_filter

751-include-fields-of-non-extensible-model-in-syncable-fields

kort-core

feature/vuejs

717-docker-improve-image-size-by-fixing-cleanup-layer

build-improvements

697-3-0-meta-issue-for-graphql-back-end-and-vue-js-frontend

185-create-notifications-for-announcement

stable-2.7

update/translation-files-13

update/translation-files-12

599-add-oauth-oidc-tests

i10n-ru-ua

tmp/cbes

do-release-2.9

docs/notifications

180-add-template-management

fix-import

653-remove-cachalot

635-test-e-mail-button

397-dedicated-public-dashboard

396-external-link-widet-auto-discovery

511-allow-custom-redirect-uri-schemes

update/translation-files-8

585-barcode-widget-for-person-fields

dot-1.6.2

281-corporate-design-for-html-mails

592-oauth2-broken-in-2-4

574-rewrite-password-change-templates

reduce-docker-steps

571-age-calculation-broken

559-oauth-add-feature-to-limit-apps-to-groups

feature/push-notifications

feature/i18n-maintenance

fix/oauth-skip-auth-detail

523-integrate-sentry-for-performance-and-error-tracing

prepare-release-2.1.dev0

release/2.0

387-jwt-provider-consumer-support

update/translation-files

496-service-worker-safari-does-not-support-broadcastchannel-api

group-members-permissions

prepare-release-2.0b2

fix/trans-conflicts

bp-2.0-use-importlib-instead-of-pkg-resources

update/translation-files-2.0b0-1

test-migration-test

376-prevent-deep-linking-to-media-files

feature/build-icons-automatically

421-update-to-django-3-2

set-sast-config-1

feature/test-selenium-capabilities

arg-apps

feature/review-app

test-docker-app-version

feature/allow-app-source

fix-ci-config

feature/curlylint

feature/gin-index-on-ext-data

backup-over-ssh

feature/keep_local_password_ldap

340-correctly-implement-the-ckeditor

143-mark-menu-entries-as-active-with-sub-sub-menu-entries

feature/django-notifs

2021-update-copyright

catch-error

update/poetry

selenium

269-photo-cropping-broken-2

269-photo-cropping-broken

fix-docker-build

has-person

update-poetry-lockfile

pages-staging

mix/conn-dne

236-support-saml-and-oauth2-logins-as-consumer

feature/custom-auth-backends-dev

dev

fix-isort

214-add-notification-dashboard-widget-anything-to-notify-of-upcoming-birthdays

157-include-django-letsagree

215-add-geolocation-of-persons

267-lint-add-spell-check

291-rename-template-references

270-ci-replace-kaniko-with-buildah

217-add-support-for-defining-group-types

feature/docker-extras

153-use-complex-name-field-with-i18n-support

debug-docker-build

feature/material-admin

pages-jonglieren

179-group-contact

169-support-nextcloud-talk-for-notifications

develop-dashboard-feeds

134-merge-dashboard-ajax

5.3.0

5.2.0

5.1.0

5.0.3

5.0.2

5.0.1

5.0.0

5.0.0b3

5.0.0b2

5.0.0b1

5.0.0b0

4.1.0.dev2

4.0.4

4.1.0.dev1

4.1.0.dev0

4.0.3

4.0.2

4.0.1

4.0.0

4.0.0.dev16

3.2.2

3.1.7

4.0.0.dev15

4.0.0.dev14

4.0.0.dev13

4.0.0.dev12

4.0.0.dev11

3.1.6

3.2.1

4.0.0.dev10

4.0.0.dev9

4.0.0.dev8

4.0.0.dev7

4.0.0.dev6

4.0.0.dev5

4.0.0.dev4

4.0.0.dev3

4.0.0.dev2

4.0.0.dev1

3.2.0

3.1.5

3.1.4

3.1.3

3.1.2

3.1.1

3.1

3.0

2.12.4

3.0b3

3.0b2

2.10.3

2.11.2

2.12.3

3.0b1

3.0b0

3.0.dev3

2.12.2

3.0.dev2

2.12.1

2.12

2.11.1

2.11

2.10.2

3.0.dev1

2.10.2.dev0

3.0.dev0

2.10.1

2.10

2.7.6

2.7.5

2.9

2.8.2.dev2

2.8.2.dev1

2.8.2.dev0

2.8.1

2.8.1.dev0

2.8

2.7.4

2.7.3

2.7.2

2.7.1

2.7

2.6

2.5

2.4

2.3.2

2.3.1

2.3

2.2.1

2.2

2.1.1

2.1

2.1.dev0

2.0

2.0rc7

2.0rc6

2.0rc5

2.0rc4

2.0rc3

2.0rc2

2.0rc1

2.0b2

2.0b1

2.0b0

2.0a4

2.0a3

2.0a2

2.0a1

1.0a3.1

1.0a3

1.0a2

1.0a1

1.0a0

0.1

Labels

Clear labels   

Security

  

TeX

Needs LaTeX template

  

auto-update

  

board

done

  

board

ready

  

board

todo

  

check

delete-eslint-rc-js

  

check

update-builddeps-package-json

  

check

update-eslint-rc-js

  

check

update-gitignore

  

check

update-merge-request-template

  

check

update-prettier-ignore

  

check

update-pyproject-toml

  

check

update-renovate-json

  

check

update-tox-ini

  

part

backend

Backend (view code, models, logic, etc.)

  

part

ci

  

part

docs

Issue or addition to the documentation

  

part

frontend

Frontend (templates, etc.)

  

part

i18n

Translation or internationalisation issue

  

part

non-technical

Non-technical (policy, maintenance, etc.) issue or discussion

  

part

packaging

Issue concerning the packaging of AlekSIS and components

  

prio

1

Priority High

  

prio

2

Priority Medium

  

prio

3

Priority Low

  

release-mr-5.x

  

size

large

  

size

medium

  

size

small

  

source

customer

Requested by a customer or affiliated user

  

source

customer::fsmw

  

source

customer::fss

  

source

customer::teckids

  

source

downstream

Issue or merge request from other projects using AlekSIS or parts of it

  

type

breaking

  

type

bug

Bug

  

type

feature

New feature

  

type

refactoring

  

workflow

blocked

Issue is blocked by another issue

  

workflow

confirmed

The bug is reproducible and will be fixed

  

workflow

current-todo

  

workflow

discussing

Needs to be discussed before implementation

  

workflow

new-app

Requires new AlekSIS app, which has to be created

  

workflow

wontfix

The bug is not reproducible or the feature was decided against

No labels

Security

TeX

auto-update

board

done

board

ready

board

todo

check

delete-eslint-rc-js

check

update-builddeps-package-json

check

update-eslint-rc-js

check

update-gitignore

check

update-merge-request-template

check

update-prettier-ignore

check

update-pyproject-toml

check

update-renovate-json

check

update-tox-ini

part

backend

part

ci

part

docs

part

frontend

part

i18n

part

non-technical

part

packaging

prio

1

prio

2

prio

3

release-mr-5.x

size

large

size

medium

size

small

source

customer

source

customer::fsmw

source

customer::fss

source

customer::teckids

source

downstream

type

breaking

type

bug

type

feature

type

refactoring

workflow

blocked

workflow

confirmed

workflow

current-todo

workflow

discussing

workflow

new-app

workflow

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

magicfelix

3 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

aleksis/AlekSIS-Core#1064

No description provided.