janiussyafiq opened a new pull request, #13808: URL: https://github.com/apache/apisix/pull/13808
### Description Add an OIDC Back-Channel Logout 1.0 receiver to the `openid-connect` plugin, following the direction from the prior-art discussion in #13792: when the identity provider notifies the gateway that a user logged out elsewhere or an administrator revoked a session, the corresponding session cookie stops being accepted immediately, instead of remaining valid until its stored token expiry. - New optional `backchannel_logout` config block: the provider POSTs a `logout_token` to `backchannel_logout.path`; after validation (JWKS signature, `iss`/`aud`/`iat`/`events`/`jti` claim checks per spec section 2.6, jti replay guard) the revoked `sid`/`sub` is written to a denylist, stored in `shm` (per-instance) or `redis` (shared across nodes, reusing `session.redis` when configured). - Every session request is checked against the denylist: a revoked session is destroyed and the request then follows `unauth_action`; if the store is unreachable, the request fails with 503 and the session is kept. - Covered by Keycloak E2E tests (sid and sub-only logout tokens, `unauth_action` variants, store-down behavior) plus a stub-IdP negative validation matrix; docs updated (en/zh). #### Which issue(s) this PR fixes: Fixes #13750 ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [x] I have added tests corresponding to this change - [x] I have updated the documentation to reflect this change - [x] I have verified that this change is backward compatible (the feature is off unless `backchannel_logout` is configured) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
