ApolloFops proposes adding support for OpenID Connect Back-Channel Logout to the core OIDC plugin. This feature would enable Single-Sign-Out by allowing the Identity Provider (IdP) to remotely invalidate sessions. Consequently, when a user logs out of another service connected to the IdP, or uses a central “log out of all sessions” function at the IdP, their Discourse session would also be terminated. ApolloFops notes that implementing this requires storing the session ID provided by the IdP to link future logout requests back to the correct Discourse session. Although willing to contribute, they acknowledge being a first-time contributor and may need assistance with the codebase structure.
merefield confirms this is a product gap and suggests using the Marketplace category if the user has the budget to hire an experienced developer. ApolloFops responds that they lack the budget but are an experienced software developer, just new to Discourse’s specific codebase. They plan to study plugin documentation and attempt to write the patch themselves.
unknowndomain expresses similar interest, noting that their Makerspace community is starting to enable SSO and would benefit significantly from Back-Channel Logout. They mention that without official support, they might resort to using AI tools like Claude to attempt a workaround.
One of the things that I would really like to see supported by the core OIDC plugin is OpenID Connect Back-Channel Logout. The introduction of back-channel logout would allow for the Identity Provider to remotely invalidate a session, allowing for Single-Sign-Out to work properly (a user can log out from another service, whether that service is the IdP directly or another service connected to the IdP via RP-initiated logout, and then when they do so they will be signed out of Discourse as well). This also allows for a central “log out of all sessions” in the IdP to work properly.
I’m happy to look into implementing this myself, but because of the need to store the Session ID that the IdP provides so that we can later link up the logout request from the IdP back to the correct session in Discourse, I may need some help given that I am a first-time contributor lol. I’ll give it a shot soon though when I have a bit more time, and I’ll write back if I run into issues.
Sadly don’t really have any budget, so I’ll just try my best to write a patch myself. I am pretty experienced with software development (the forum I manage is actually for software that I’m making lol), I’ve just never worked with Discourse’s codebase before and it looks a little intimidating lol. I think I have a pretty good idea of what I need to do though, I just need to learn how Discourse plugins are structured (seems like there’s pretty decent documentation for this, and I can’t imagine it’s too hard to figure out, just have not had time to look into this yet).
This is a feature we’re look for to support our Makerspace community too as we’re just starting to enable SSO and BCL would be really useful, we’d otherwise probably intend to throw Claude at the problem and see what it can achieve.