OIDC Back Channel Logout

[Bensonheimer992]

Summary

Add Back-Channel Logout Support for the Generic OAuth Provider

Motivation

If you log in via OIDC and your session with the OIDC provider ends, you will not be logged out of Pangolin.

Proposed Solution

When you create an OIDC provider, you receive a back-channel logout URL that you can configure with the provider

Alternatives Considered

No response

Additional Context

No response

[AstralDestiny]

Would also be nice to define a rewrite instead of doing it with middlewares that if you call pangolin logout it calls the defined oidc logout path.

[jomichaelis]

Adding the other direction to this request: RP-initiated logout (Pangolin → IdP).

Today, logging out of Pangolin only ends the Pangolin session. The IdP session (Authentik in my
case) stays active, so the next "Login with " silently signs the same account back in:

• Switching accounts (e.g. normal user → separate admin account) requires logging out of
  Pangolin and manually out of the IdP — I was denied an admin-only resource because Pangolin
  was still using my non-admin account after I had "switched" in Authentik.
• On a shared device, "Logout" in Pangolin doesn't really log you out.

Proposal: an optional per-IdP "End session URL" (or end_session_endpoint from discovery)
plus a toggle "Also log out of the identity provider". On logout, Pangolin would redirect to it
with id_token_hint, client_id and post_logout_redirect_uri (back to the Pangolin login page).
#4027 already keeps the IdP tokens, so the ID token should be available.

Together with back-channel logout (this request), logout would work in both directions.

Environment: Pangolin EE 1.26.0, Authentik 2026.8.2 (advertises end_session_endpoint).