Logging out of OpenID Connect provider

[flortsch]

Description

If you login to Gitea using an OpenID Connect provider (e.g., Keycloak) and logout again, you are logged out of Gitea, but you are still logged in at your OpenID provider. Clicking at the OpenID login button at the Gitea page will automatically log you back into the same account. It should be possible to also log out at the OpenID provider. Keycloak, as an example, provides a logout endpoint where you can logout from the OpenID provider and redirect back to the application, which could be used by Gitea when logging out (e.g., https://your-keycloak.com/auth/realms/example-realm/protocol/openid-connect/logout?redirect_uri=https%3A%2F%2Fyour-gitea.com%2F).

Related issue in past: #12374

[zeripath]

I didn't realise that there were specs for this - but:

https://medium.com/@robert.broeckelmann/openid-connect-logout-eccc73df758f

https://curity.io/resources/architect/openid-connect/openid-connect-logout/
https://openid.net/specs/openid-connect-frontchannel-1_0.html
https://openid.net/specs/openid-connect-backchannel-1_0.html

may be helpful for implementation.

[Baitanik]

Is There any plan when this issue will be fixed ?
Log out from gitea , actually does not log out from oidc provider ..

[kimdre]

It would be nice to have this feature implemented. 👍

[Adphi]

Perhaps the simplest way to implement this is to use the RP Initiated Logout spec

[qworkz11]

Hi,
is there a workaround in order to achieve a logout at the OIDC provider until this feature is implemented?