Implement OIDC RP-Initiated Logout #259

WilliamDenniss · 2018-06-26T18:20:31Z

http://openid.net/specs/openid-connect-session-1_0.html#RPLogout

Implements #132. Fixes #258.

codecov-io · 2018-06-26T18:34:03Z

Codecov Report

Merging #259 into master will decrease coverage by 1.67%.
The diff coverage is 44.66%.

@@            Coverage Diff             @@
##           master     #259      +/-   ##
==========================================
- Coverage   73.93%   72.25%   -1.68%     
==========================================
  Files          58       63       +5     
  Lines        5102     5374     +272     
==========================================
+ Hits         3772     3883     +111     
- Misses       1330     1491     +161

Impacted Files	Coverage Δ
Source/OIDAuthorizationService.h	`0% <ø> (ø)`	⬆️
Source/OIDEndSessionResponse.m	`0% <0%> (ø)`
Source/OIDEndSessionResponse.h	`0% <0%> (ø)`
Source/OIDEndSessionRequest.h	`100% <100%> (ø)`
Source/OIDServiceConfiguration.h	`100% <100%> (ø)`	⬆️
Source/OIDServiceDiscovery.m	`93.5% <100%> (-0.13%)`	⬇️
UnitTests/OIDEndSessionRequestTests.m	`100% <100%> (ø)`
UnitTests/OIDServiceDiscoveryTests.m	`84.61% <100%> (-0.34%)`	⬇️
Source/OIDAuthorizationService.m	`53.86% <12.08%> (-8.7%)`	⬇️
Source/OIDServiceConfiguration.m	`72.89% <50%> (-5.52%)`	⬇️
... and 9 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 28fc6c6...ea5ad45. Read the comment docs.

StevenEWright · 2018-07-06T23:32:31Z

LGTM! Awesome!

julienbodet · 2018-07-07T22:35:33Z

Source/OIDAuthorizationService.m

+    @param redirectonURL The second redirect URI to compare.
+    @return YES if the URLs match down to the path level (query params are ignored).
+ */
+ (BOOL)URL:(NSURL *)URL matchesRedirectonURL:(NSURL *)redirectonURL {


Typo matchesRedirectionURL

julienbodet · 2018-07-07T22:36:04Z

Source/OIDAuthorizationService.m

-      OIDIsEqualIncludingNil(standardizedURL.host, standardizedRedirectURL.host) &&
-      OIDIsEqualIncludingNil(standardizedURL.port, standardizedRedirectURL.port) &&
-      OIDIsEqualIncludingNil(standardizedURL.path, standardizedRedirectURL.path);
+  NSURL *standardizedRedirectURL = [redirectonURL standardizedURL];


[redirectionURL standardizedURL]

julienbodet · 2018-07-07T22:37:27Z

Source/OIDAuthorizationService.m

- (BOOL)shouldHandleURL:(NSURL *)URL {
+/*! @brief Does the redirection URL equal another URL down to the path component?
+    @param URL The first redirect URI to compare.
+    @param redirectonURL The second redirect URI to compare.


Typo redirectionURL

julienbodet · 2018-07-07T22:44:15Z

Source/OIDAuthorizationService.m

+  BOOL authorizationFlowStarted =
+      [_externalUserAgent presentExternalUserAgentRequest:_request session:self];
+  if (!authorizationFlowStarted) {
+    NSError *safariError = [OIDErrorUtilities errorWithCode:OIDErrorCodeSafariOpenError


I know this is not directly related to this PR, but I wonder if this error type should be renamed to something like OIDErrorCodeBrowserOpenError or OIDErrorCodeExternalUserAgentOpenError since AppAuth now supports other browsers? The description is also mentioning Safari.

Amnell · 2018-08-02T07:17:21Z

I've been looking for a nice way to handle logout and this PR looks great. I've tested it in my project and it works great, except that the completion is not called. I've had a look at the code and it looks like shouldHandleURL: returns false as it compares the callbackURL from SFAuthenticationSession with _request.endSessionRequestURL. My callbackURL from SFAuthenticationSession is my custom url scheme for my app.

I'm not fluent in the openid spec, but is this really expected behaviour?

@WilliamDenniss @julienbodet

dilee · 2018-08-10T10:22:54Z

Hi @Amnell
Do you have any sample code where you've used this improvement? I couldn't find a way to persist the session to avoid clearing session cookies when the app is closed and cleared from memory.

@WilliamDenniss @julienbodet

danipralea · 2018-08-17T12:17:50Z

Hello @WilliamDenniss @julienbodet I am having the same issues as @dilee . I am unable to remove the cookies so that at the next login the login is a fresh one. It automatically logs in with the previous user instead.

@Amnell would you be kind enough to share what you have working? Thanks.

omgitstom · 2018-08-27T16:45:06Z

Hey @WilliamDenniss - curious if you had any status/timeline for this. Okta is getting a few requests a week for this functionality in https://github.com/okta/okta-sdk-appauth-ios

We are trying to figure out if we can rely on this functionality in this library or if we need to circumvent and built it ourselves.

Thanks for any updates!

WilliamDenniss · 2018-09-18T21:16:33Z

Hey @omgitstom, do you mean the timeline of when it gets merged into master?

The main thing I was waiting for was confirmation that it actually works as I don't have a test server with an end-session endpoint myself. Looks like there's at least one bug which should be fixed by #285, but other than that it might be ready.

Have you tried out this branch with Okta's end session endpoint? Does it work? Is there a public test instance I can try?

I would encourage everyone who has tried this code against their own end session endpoints to post their results. If the code is demonstrated to work in an interoperable way, I'll get it merged.

mattio · 2018-10-18T14:18:05Z

I've been using this in our Identity Server internal test environment along with @AndrewMcDrew's tweak in #285, my tweak in #312, and iOS 12 support from that branch added manually. So far it's been working as expected for me.

WilliamDenniss · 2018-10-18T17:44:24Z

@mattio, thanks for reporting back your results! I don't have any need for Logout myself, so I'm relying on y'all to test & validate the implementation here.

Based on your comments, I merged those 2 PRs. I also rebased our dev branch onto master, for iOS 12 / Xcode 10 support. The old work pre-rebase is here if anyone needs macOS 32-bit support for some reason (NB, that tag is not supported at all, you'd be own your own there).

Can everyone checkout the latest dev-logout branch, give it a try, and report back? You'll need to git rest --hard origin/dev-logout due to the rebase (which will also blast away any local changes, be warned).

Once a few people independently confirm that this actually works for them, we can look at getting it merged.

WilliamDenniss · 2019-05-30T16:16:06Z

@julienbodet rebased onto latest master (#393)

WilliamDenniss · 2019-05-31T20:51:59Z

@yurikoles

There is another issue, on newer iPads there is an alert/dialog before opening browser window on logout, that disappears immediately with no chance to accept it.

Do you have a strong reference to the session object? I think this happens if the object gets deallocated.

Please file a bug if you have a test case that can be repro'd

WilliamDenniss · 2019-05-31T20:54:17Z

@blork

This is looking good, just implemented it and it's working great. However, I have my users signing in using the embedded browser (SFAuthenticationSession/ASWebAuthenticationSession), so kicking them out to "real" Safari to logout is a bit jarring. Is there a way a method for showing SFSafariViewController for this could be added (or can someone give me a hint on how to implement this myself)?

I'm not quite following, Logout should use the same user-agent as login, should it not? At least, that is the intention.

WilliamDenniss · 2019-05-31T21:11:58Z

@yurikoles

@WilliamDenniss logout doesn't work in Swift:

When I try to call: OIDAuthorizationService.present(endSessionRequest, externalUserAgent: OIDExternalUserAgentIOS, callback: { (response, error)} )

Auth.swift:322:13: error: ambiguous reference to member 'present(_:externalUserAgent:callback:)'
            OIDAuthorizationService.present(endSessionRequest, externalUserAgent: OIDExternalUserAgentIOS, callback: { (response, error) in
            ^~~~~~~~~~~~~~~~~~~~~~~
AppAuth.OIDAuthorizationService:12:21: note: found this candidate
    open class func present(_ request: OIDAuthorizationRequest, externalUserAgent: OIDExternalUserAgent, callback: @escaping OIDAuthorizationCallback) -> OIDExternalUserAgentSession
                    ^
AppAuth.OIDAuthorizationService:15:21: note: found this candidate
    open class func present(_ request: OIDEndSessionRequest, externalUserAgent: OIDExternalUserAgent, callback: @escaping OIDEndSessionCallback) -> OIDExternalUserAgentSession

Can you file a separate issue for this one? It's getting too unwieldy to track so many issues in one thread.

When you do, can you share the code snippit as well?

yurikoles · 2019-05-31T21:12:07Z

Swift ambiguity is still there. Even login is broken in Swift on this branch.

error: ambiguous reference to member 'authState(byPresenting:externalUserAgent:callback:)'
            OIDAuthState.authState(byPresenting: request,
            ^~~~~~~~~~~~
AppAuth.OIDAuthState:12:21: note: found this candidate
    open class func authState(byPresenting authorizationRequest: OIDAuthorizationRequest, externalUserAgent: OIDExternalUserAgent, callback: @escaping OIDAuthStateAuthorizationCallback) -> OIDExternalUserAgentSession
                    ^
AppAuth.OIDAuthState:2:21: note: found this candidate
    open class func authState(byPresenting authorizationRequest: OIDAuthorizationRequest, presenting presentingViewController: UIViewController, callback: @escaping OIDAuthStateAuthorizationCallback) -> OIDExternalUserAgentSession

WilliamDenniss · 2019-05-31T21:13:24Z

Can you file a dedicated issue for this, and provide the sample code that generates the error?

yurikoles · 2019-05-31T22:17:49Z

@WilliamDenniss tried to create a use-case for issue, but I can't reproduce this in new project or official example. Seems to be very rare issue which my project.

WilliamDenniss · 2019-05-31T22:26:21Z

Thanks for confirming. I was surprised by this error, as I would expect Swift to infer the type and therefore not have any ambiguity. Maybe you could explicitly declare the variable with the type?

WilliamDenniss · 2019-05-31T22:26:51Z

Well, I'm happy that enough people have tried this without problems.

Merging soon. #YOLO

pgorzelany-objectivity · 2019-06-04T11:29:51Z

@WilliamDenniss any chance this will be merged and released soon?

– Switched constructor to fieldMap pattern like the rest of AppAuth – Corrected indentation.

Fixed indentation.

…ynthesize the endSessionEndpoint property for consistency

Mirroring changes made in eb59c89.

WilliamDenniss · 2019-06-11T00:30:23Z

Merged.

The dev-logout branch will be deleted, please update your Podfiles if you were using that branch.

wilmarvh · 2019-06-26T10:38:51Z

@WilliamDenniss Any timing on an officially tagged release with logout functionality included?

ivanhjel · 2019-07-24T09:07:26Z

☝️ Is this available now?

WilliamDenniss requested a review from StevenEWright June 26, 2018 18:20

This was referenced Jun 26, 2018

Logout support for external Revocation Endpoint #255

Open

WIP: Controller logic for RP-initiated logout #219

Closed

WilliamDenniss added enhancement openid-cla: yes in-scope The AppAuth 406 Not Acceptable believe this is in-scope for AppAuth. labels Jun 26, 2018

WilliamDenniss force-pushed the dev-logout branch 2 times, most recently from 27b4833 to 8680736 Compare July 6, 2018 19:19

julienbodet reviewed Jul 7, 2018

View reviewed changes

WilliamDenniss force-pushed the dev-logout branch from 8680736 to 8aad291 Compare July 13, 2018 17:18

This was referenced Jul 17, 2018

Require a redirect flow for end_session endpoint handling openid/AppAuth-JS#52

Open

Feature Request: Support End Session (and Generic External User-Agent requests) openid/AppAuth-Android#374

Closed

omgitstom mentioned this pull request Aug 27, 2018

Add support for Logout okta/okta-oidc-ios#7

Closed

mattio mentioned this pull request Aug 30, 2018

Forcing the user to enter their username and password again #281

Closed

AndrewMcDrew mentioned this pull request Sep 12, 2018

Fixed an end session callback #285

Merged

WilliamDenniss force-pushed the dev-logout branch 2 times, most recently from 45bb8c5 to 4635c48 Compare October 18, 2018 17:42

WilliamDenniss force-pushed the dev-logout branch from 4635c48 to eb0b4cd Compare October 18, 2018 17:45

WilliamDenniss mentioned this pull request May 30, 2019

Merge or update the dev-logout branch #393

Closed

WilliamDenniss force-pushed the master branch from bac3ed0 to 4062c9c Compare May 31, 2019 20:40

WilliamDenniss force-pushed the dev-logout branch from 80ce826 to 914dd99 Compare May 31, 2019 22:05

WilliamDenniss force-pushed the dev-logout branch from 914dd99 to fa66e92 Compare May 31, 2019 22:31

WilliamDenniss force-pushed the master branch from de7550c to 820793e Compare June 1, 2019 00:45

Lucas Farris and others added 7 commits June 10, 2019 16:43

Added the End Session request/response for the RP-Initiated Logout

68648b9

Add additionalParemters support to OIDEndSessionResponse

49380af

– Switched constructor to fieldMap pattern like the rest of AppAuth – Corrected indentation.

Implement OIDExternalUserAgentRequest in OIDEndSessionRequest

9ea9107

Fixed indentation.

Add end_session_endpoint support to OIDServiceConfiguration

d62069a

Implement OIDC RP-initiated logout actions

1b8fd79

Add the end session endpoint to -description and -encodeWithCoder:, s…

d5e8f6a

…ynthesize the endSessionEndpoint property for consistency

Remove support for 32-bit macOS from EndSession models

ea5ad45

Mirroring changes made in eb59c89.

WilliamDenniss force-pushed the dev-logout branch from fa66e92 to ea5ad45 Compare June 10, 2019 23:45

WilliamDenniss merged commit ca70481 into master Jun 11, 2019

dewniMW mentioned this pull request Mar 9, 2021

SSO for Native iOS sample application is not working properly. wso2/product-is#11409

Open

RyoukoKonpaku mentioned this pull request Aug 11, 2021

authorize() caches credentials FormidableLabs/react-native-app-auth#621

Closed

gispada mentioned this pull request Dec 8, 2021

OpenID Connect RP Initiated Logout FormidableLabs/react-native-app-auth#693

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Implement OIDC RP-Initiated Logout #259

Implement OIDC RP-Initiated Logout #259

WilliamDenniss commented Jun 26, 2018

codecov-io commented Jun 26, 2018 •

edited

Loading

StevenEWright commented Jul 6, 2018

julienbodet Jul 7, 2018

julienbodet Jul 7, 2018 •

edited

Loading

julienbodet Jul 7, 2018 •

edited

Loading

julienbodet Jul 7, 2018 •

edited

Loading

Amnell commented Aug 2, 2018 •

edited

Loading

dilee commented Aug 10, 2018 •

edited

Loading

danipralea commented Aug 17, 2018 •

edited

Loading

omgitstom commented Aug 27, 2018

WilliamDenniss commented Sep 18, 2018

mattio commented Oct 18, 2018 •

edited

Loading

WilliamDenniss commented Oct 18, 2018

WilliamDenniss commented May 30, 2019

WilliamDenniss commented May 31, 2019 •

edited

Loading

WilliamDenniss commented May 31, 2019

WilliamDenniss commented May 31, 2019

yurikoles commented May 31, 2019

WilliamDenniss commented May 31, 2019

yurikoles commented May 31, 2019

WilliamDenniss commented May 31, 2019

WilliamDenniss commented May 31, 2019 •

edited

Loading

pgorzelany-objectivity commented Jun 4, 2019 •

edited

Loading

WilliamDenniss commented Jun 11, 2019

wilmarvh commented Jun 26, 2019

ivanhjel commented Jul 24, 2019

Implement OIDC RP-Initiated Logout #259

Implement OIDC RP-Initiated Logout #259

Conversation

WilliamDenniss commented Jun 26, 2018

codecov-io commented Jun 26, 2018 • edited Loading

Codecov Report

StevenEWright commented Jul 6, 2018

julienbodet Jul 7, 2018

Choose a reason for hiding this comment

julienbodet Jul 7, 2018 • edited Loading

Choose a reason for hiding this comment

julienbodet Jul 7, 2018 • edited Loading

Choose a reason for hiding this comment

julienbodet Jul 7, 2018 • edited Loading

Choose a reason for hiding this comment

Amnell commented Aug 2, 2018 • edited Loading

dilee commented Aug 10, 2018 • edited Loading

danipralea commented Aug 17, 2018 • edited Loading

omgitstom commented Aug 27, 2018

WilliamDenniss commented Sep 18, 2018

mattio commented Oct 18, 2018 • edited Loading

WilliamDenniss commented Oct 18, 2018

WilliamDenniss commented May 30, 2019

WilliamDenniss commented May 31, 2019 • edited Loading

WilliamDenniss commented May 31, 2019

WilliamDenniss commented May 31, 2019

yurikoles commented May 31, 2019

WilliamDenniss commented May 31, 2019

yurikoles commented May 31, 2019

WilliamDenniss commented May 31, 2019

WilliamDenniss commented May 31, 2019 • edited Loading

pgorzelany-objectivity commented Jun 4, 2019 • edited Loading

WilliamDenniss commented Jun 11, 2019

wilmarvh commented Jun 26, 2019

ivanhjel commented Jul 24, 2019

codecov-io commented Jun 26, 2018 •

edited

Loading

julienbodet Jul 7, 2018 •

edited

Loading

julienbodet Jul 7, 2018 •

edited

Loading

julienbodet Jul 7, 2018 •

edited

Loading

Amnell commented Aug 2, 2018 •

edited

Loading

dilee commented Aug 10, 2018 •

edited

Loading

danipralea commented Aug 17, 2018 •

edited

Loading

mattio commented Oct 18, 2018 •

edited

Loading

WilliamDenniss commented May 31, 2019 •

edited

Loading

WilliamDenniss commented May 31, 2019 •

edited

Loading

pgorzelany-objectivity commented Jun 4, 2019 •

edited

Loading