gada121982 commented on code in PR #10437:
URL: https://github.com/apache/gravitino/pull/10437#discussion_r2942773327
##########
web-v2/web/src/lib/store/auth/index.js:
##########
@@ -102,8 +102,32 @@ export const logoutAction =
createAsyncThunk('auth/logoutAction', async ({ route
try {
const provider = await oauthProviderFactory.getProvider()
if (provider) {
+ // For OIDC providers, use signoutRedirect to end Keycloak session
+ if (provider.getUserManager) {
+ const userManager = provider.getUserManager()
+ if (userManager) {
+ // Clear legacy auth tokens before redirect
+ localStorage.removeItem('accessToken')
+ localStorage.removeItem('authParams')
+ localStorage.removeItem('expiredIn')
+ localStorage.removeItem('isIdle')
+ localStorage.removeItem('version')
+
+ dispatch(clearIntervalId())
+ dispatch(setAuthToken(''))
+
+ // Redirect to IdP logout endpoint — this will navigate away from
the app
+ // signoutRedirect() must be called before clearAuthData() because
it needs
+ // the stored id_token for the id_token_hint parameter in
RP-initiated logout
+ await userManager.signoutRedirect()
+
+ await provider.clearAuthData()
+
+ return { token: null }
+ }
+ }
+
await provider.clearAuthData()
Review Comment:
Good catch — fixed in 024593e. Adopted your suggested flow exactly:
1. `getUser()` → save `id_token` before clearing
2. `clearAuthData()` → `removeUser()` from storage
3. Local cleanup (localStorage, Redux)
4. `signoutRedirect({ id_token_hint: user?.id_token })` — last line, browser
navigates away
Dead code removed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
