Authentication token not being revoked in browser when using external OIDC provider

[betaigeuze]

Basically what's described here.

I have the same issue with my self hosted instance that uses PocketID as the OIDC.

I log into the dashboard with my PocketID user - log out, then also log out of PocketID. When I then open the dashboard again, I am immediately logged in to the authenticated session from before.

It seems like the auth token is not being revoked when logging out.

As this happened with both Authentik (like in the reddit case) and PocketID, I would assume that it is a netbird issue.

[jnfrati]

Hey @betaigeuze moved this to a discussion as per issue creation lifecycle explained here #6075.

With that covered, I would love to ask a couple of questions regarding this topic:

• Could you share what is the specific netbird-server and dashboard version you're using?
• Are both users using the same IdP provider? Or is this also happening on two different IdP providers?
• When you logout, are you seeing this screen? Or are you only seeing the external idp logout screen? (e.g pocketid)

[betaigeuze]

Could you share what is the specific netbird-server and dashboard version you're using?

I'm on Management v0.72.4 and Dashboard v2.39.0

Are both users using the same IdP provider? Or is this also happening on two different IdP providers?

For my case, I have two users, one is a local user, the other is from PocketID.
I didn't experience the exact same behaviour as quoted in the reddit discussion though, but I thought it was so similar that it must be related.
When I log out (from the PocketID session), then open the page again, I am immediately logged back in as the PocketID user.

When you logout, are you seeing this screen? Or are you only seeing the external idp logout screen? (e.g pocketid)

I do not. I am brought to https://MY_POCKETID_DOMAIN.com/login?redirect=%2Flogout and see the following:

Note that this worked fine before as far as I can tell, so I would be surprised if this was a misconfiguration issue.

[jnfrati]

I see, just to double check, could you confirm you have the logout callback url https://<your-management-url>/oauth2/logout/callback registered in the pocketid oidc client?

[betaigeuze]

I did not...
My bad - just a misconfiguration then.

I also tried to replicate the issue described in the reddit post (after adding the logout callback URL) and could not replicate it, so it might just be that we have it both misconfigured.

Thanks for the amazing work you're doing, netbird is awesome!