Implement OIDC back-channel-logout

[guimard]

As describe in TWP #132, we want to have logout. The only unbuggy way to do it is to use OIDC Back Channel Logout like Twake-Mail and Twake-Chat.

Please implement it (with backchannel_logout_session_required, to avoid deleting all sessions).

[shepilov]

• Implements session storage with sub/sid
• Add sid to the Twake Drive access token
• Validate sid on every Twake Drive request
• Implement backchannel logout URI with logout token validation

[shepilov]

@guimard logout URL should be with POST like this?

/backchannel_logout HTTP/1.1
Host: rp.example.org
Content-Type: application/x-www-form-urlencoded
logout_token=eyJhbGci...

[guimard]

@guimard logout URL should be with POST like this?

/backchannel_logout HTTP/1.1 Host: rp.example.org Content-Type: application/x-www-form-urlencoded logout_token=eyJhbGci...

Yes this is exactly what OP does

[guimard]

Hi @shepilov, could you give me the URL to set in LLNG conf ?

[shepilov]

@guimard https://drive.stg.lin-saas.com/internal/services/console/v1/backchannel_logout
I've just deployed it on the staging

[guimard]

Configuration updated, let's test. Note that it may fail until @rezk2ll study the new flow