Baoyuantop commented on issue #13750: URL: https://github.com/apache/apisix/issues/13750#issuecomment-6582511911
I'm taking over the follow-up on this issue. The planned approach is to invalidate the gateway's Cookie session when it receives an OIDC back-channel logout notification from the identity provider. The next steps are: 1. **Session revocation:** I've submitted [lua-resty-session #215](https://github.com/bungle/lua-resty-session/pull/215), continuing #212, to support revocation by subject or IdP session ID. Local tests and lint pass; upstream review is pending. 2. **OIDC notification handling:** Continue the receiver and logout-token validation work tracked in [lua-resty-openidc #572](https://github.com/zmartzone/lua-resty-openidc/issues/572), using the session library's agreed APIs. 3. **APISIX integration:** Rework the integration tracked in #13808, which is currently a draft, to use those upstream APIs. Then update dependencies and run end-to-end checks for external logout, re-login/user switching, and cross-node revocation, including cache propagation and storage failures. This plan addresses IdP-driven session invalidation. Automatically refreshing a token or retrying a request after an arbitrary upstream `401` is outside this change. You mentioned that your backend already receives logout notifications. Could you confirm which IdP you use and whether the logout/revocation operations described here can also send a standard OIDC back-channel logout notification to the APISIX client? That will help verify that this approach covers your scenario. There is no target release or ETA yet; that depends on upstream review and completion of the integration. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
