Implements https://openid.net/specs/openid-connect-backchannel-1_0.html
When --oidc-backchannel-logout is set (requires --session-store-type=redis),
the proxy exposes POST /oauth2/backchannel-logout. The OIDC provider (e.g.
Keycloak, Azure AD) can POST a signed logout_token to instantly revoke a
user's session server-side without a browser redirect.
Changes:
- oauthproxy.go: BackChannelLogout handler; route registered only when the
flag is set; validates logout_token JWT per spec §2.4 (nonce absence,
backchannel-logout event, sid claim)
- pkg/apis/sessions/interfaces.go: BackChannelSessionStore interface with
ClearBySID(ctx, sessionID) error
- pkg/apis/sessions/session_state.go: SessionID field (sid OIDC claim)
- pkg/sessions/persistence/manager.go: ClearBySID implementation and a
secondary sid→ticketID index written on every Save
- pkg/sessions/persistence/manager_test.go: unit tests for ClearBySID
- pkg/sessions/tests/mock_store.go: CacheSize() helper for tests
- providers/provider_data.go: BackChannelLogoutSupported field
- providers/provider_data.go: extracts sid claim into SessionState on login
- providers/providers.go: wires oidcConfig.backChannelLogoutEnabled
- pkg/apis/options/providers.go: BackChannelLogoutEnabled option
- pkg/apis/options/legacy_options.go: --oidc-backchannel-logout flag
- oauthproxy_test.go: unit tests for the BackChannelLogout handler
- docs: back-channel logout section in keycloak_oidc.md and openid_connect.md
Signed-off-by: Antonio Aranda Hernández <aaranda@hortichuelas.es>
* feat: readiness check
* fix: no need for query param
* docs: add a note
* chore: move the readyness check to its own endpoint
* docs(cr): add godoc
Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>
* Add sensible logging flag to default setup for logger
* Add Redis lock
* Fix default value flag for sensitive logging
* Split RefreshSessionIfNeeded in two methods and use Redis lock
* Small adjustments to doc and code
* Remove sensible logging
* Fix method names in ticket.go
* Revert "Fix method names in ticket.go"
This reverts commit 408ba1a1a5.
* Fix methods name in ticket.go
* Remove block in Redis client get
* Increase lock time to 1 second
* Perform retries, if session store is locked
* Reverse if condition, because it should return if session does not have to be refreshed
* Update go.sum
* Update MockStore
* Return error if loading session fails
* Fix and update tests
* Change validSession to session in docs and strings
* Change validSession to session in docs and strings
* Fix docs
* Fix wrong field name
* Fix linting
* Fix imports for linting
* Revert changes except from locking functionality
* Add lock feature on session state
* Update from master
* Remove errors package, because it is not used
* Only pass context instead of request to lock
* Use lock key
* By default use NoOpLock
* Remove debug output
* Update ticket_test.go
* Map internal error to sessions error
* Add ErrLockNotObtained
* Enable lock peek for all redis clients
* Use lock key prefix consistent
* Fix imports
* Use exists method for peek lock
* Fix imports
* Fix imports
* Fix imports
* Remove own Dockerfile
* Fix imports
* Fix tests for ticket and session store
* Fix session store test
* Update pkg/apis/sessions/interfaces.go
Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>
* Do not wrap lock method
Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>
* Use errors package for lock constants
* Use better naming for initLock function
* Add comments
* Add session store lock test
* Fix tests
* Fix tests
* Fix tests
* Fix tests
* Add cookies after saving session
* Add mock lock
* Fix imports for mock_lock.go
* Store mock lock for key
* Apply elapsed time on mock lock
* Check if lock is initially applied
* Reuse existing lock
* Test all lock methods
* Update CHANGELOG.md
* Use redis client methods in redis.lock for release an refresh
* Use lock key suffix instead of prefix for lock key
* Add comments for Lock interface
* Update comment for Lock interface
* Update CHANGELOG.md
* Change LockSuffix to const
* Check lock on already loaded session
* Use global var for loadedSession in lock tests
* Use lock instance for refreshing and releasing of lock
* Update possible error type for Refresh
Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>
Antonio Aranda Hernández
Kobi Meirson
Kevin Kreitner
Joel Speed