Support OIDC Backchannel Logout

Contribute Feature

AI-generated summary

ApolloFops requests support for OpenID Connect Back-Channel Logout in the core OIDC plugin. This feature would enable proper Single-Sign-Out by allowing the Identity Provider (IdP) to remotely invalidate sessions, ensuring users are logged out of Discourse when they sign out from other connected services or use a central “log out of all sessions” function. The implementation requires storing the Session ID provided by the IdP to link future logout requests to the correct Discourse session.

merfield acknowledges this as a product gap and suggests using Marketplace if budget is available for experienced developers. However, ApolloFops confirms they lack the budget and plan to attempt the implementation themselves. Although they are experienced software developers, they note that the Discourse codebase appears intimidating for a first-time contributor. They intend to learn the plugin structure using existing documentation and will share updates or ask for help if they encounter difficulties.

1

One of the things that I would really like to see supported by the core OIDC plugin is OpenID Connect Back-Channel Logout. The introduction of back-channel logout would allow for the Identity Provider to remotely invalidate a session, allowing for Single-Sign-Out to work properly (a user can log out from another service, whether that service is the IdP directly or another service connected to the IdP via RP-initiated logout, and then when they do so they will be signed out of Discourse as well). This also allows for a central “log out of all sessions” in the IdP to work properly.

I’m happy to look into implementing this myself, but because of the need to store the Session ID that the IdP provides so that we can later link up the logout request from the IdP back to the correct session in Discourse, I may need some help given that I am a first-time contributor lol. I’ll give it a shot soon though when I have a bit more time, and I’ll write back if I run into issues.

1 Like
2

This is indeed a product gap.

If you want someone more experienced to look at this and can arrange budget consider Marketplace

3

Sadly don’t really have any budget, so I’ll just try my best to write a patch myself. I am pretty experienced with software development (the forum I manage is actually for software that I’m making lol), I’ve just never worked with Discourse’s codebase before and it looks a little intimidating lol. I think I have a pretty good idea of what I need to do though, I just need to learn how Discourse plugins are structured (seems like there’s pretty decent documentation for this, and I can’t imagine it’s too hard to figure out, just have not had time to look into this yet).