/oauth2/sign_out end point should redirect the user to the providers end_session_endpoint by default

[9876691]

Expected Behavior

When I refer the user to /oauth2/sign_out then after oauth2 proxy deletes it's cookies it would be great if we redirect the user to the end session end point. end_session_endpoint

Also, perhaps we shouldn't need to add the URL to a whitelist, as it's already defined in the openid configuration.

Current Behavior

Currently my application needs to know the end session endpoint and include that in the rd redirect parameter. I also have to manage a white list.

Apart from that my app is unaware of the OIDC config.

Possible Solution

If I don't supply the rd redirect then perhaps forward the user to the end_session_endpoint by default?

I'm not sure of the consequences of this for other users, but for me this would have saved some time figuring out the sign out mechanism.

Context

Currently we will have to build code to pass the end_session_endpoint into the app, then add this to an rd parameter.

But the config already exists in Oauth2 so it seems a shame not to use it.

[robertsmaoui]

@tomtaylor @dhowden

[JoelSpeed]

Does the recently merged #1876 help here at all?

[github-actions]

This issue has been inactive for 60 days. If the issue is still relevant please comment to re-activate the issue. If no action is taken within 7 days, the issue will be marked closed.