Hi Ray, Sorry for not having replied earlie, I'm a bit ashamed :( (I was working on other topics, but still my fault I was asking the question in the first place) The use case for having this regex is that I'm using the same client for multiple applications. Hence:- I'm using the same clientId for multiple front end apps (i.e. app1.mysite.com, app2.mysite.com, etc...).- so atm, I have a serviceId like "serviceId": "http://.+\.mysite.com/.*"; - I'd have liked to use a similar logoutUrl "logoutUrl": "http://.+\.mysite.com/.*";
And I'm using OIDC implicit flow and the OIDC front end logout mechanism for all this - hence my client is a front end app. And when my client initiated a OIDC logout request, the client app could do something like this URL:https://cas.local/cas/oidc/logout?id_token_hint=xxx&post_logout_redirect_uri=https%3A%2F%2Fmyapp.com%2Fauth%2Flogout That is the OIDC client can send a particular logoutUrl.CAS can then check that this particular URL is one of the registered logoutUrls and can then redirect back to this particular Url. Looking at the current implementation in CAS, I see that 2 CAS components are involved in the logout process: OidcLogoutEndpointController and LogoutAction. And LogoutAction is being used by SAML, CAS and OIDC protocols.Hence not so easy to fit the logoutUrl as a feature without impacting the other protocols. >From what I see in the code, OidcLogoutEndpointController retrieves the asked >logoutUrl from post_logout_redirect_uri and checks that it correspond one of >the logoutUrl of the registered client (it uses id_token_hint to retrieve the >client).It then propagates the asked logoutUrl as the 'service' parameter to >LogoutAction.LogoutAction uses this parameter as serviceId to retrieve check >that the client is registered (btw, it implied that the logoutUrl matches the >serviceId - I don't get the rationale).If it matches, then it redirects to the >asked logoutUrl.btw, using the debugger I see that needFrontSlo=false in the >LogoutAction (I would have expected it to be true since my client is a front >end). So all in all, I don't see an elegant way to implement this corner case feature atm :( Thanks,Adrian Le jeudi 5 mars 2020 à 20:30:33 UTC+1, Ray Bon <[email protected]> a écrit : Adrian, If logout URL is not set in service definition, the one passed to cas during login is used.How would cas know where to send the logout request with a regex? What is the use case with regard to OIDC that a regex might be useful? Perhaps allow for a list of URLs. I am not familiar enough with other CAS clients but the java cas client uses filters to check incoming requests. Thus, the actual target URI does not matter (path, parameters, etc). Ray On Thu, 2020-03-05 at 09:26 -0800, gonzalad na wrote: Hello, I'm a new CAS User (CAS 6.1.4), I'm using OIDC for logout. Is there a way to use a regex as logoutUrl (in the same way it's possible to use a regex for the serviceId ?) If not is it possible to contribute to have this feature in CAS ? I suspect a simple change in OidcLogoutEndpointController (https://github.com/apereo/cas/blob/d8552017af435e5894006efb64922f50e107349a/support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/web/controllers/logout/OidcLogoutEndpointController.java#L70-L75) should do the trick. But this would impact existing CAS users. wdyt ? Thanks very much,Adrian -- Ray BonProgrammer AnalystDevelopment Services, University Systems2507218831 | CLE 019 | [email protected] I respectfully acknowledge that my place of work is located within the ancestral, traditional and unceded territory of the Songhees, Esquimalt and WSÁNEĆ Nations. -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/62e1a4c4d205153d1dce433fec283405c15fd1e0.camel%40uvic.ca. -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/1226932510.810458.1583952679257%40mail.yahoo.com.
