jhodgkin/homelab-monitor
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Sign out should also end the Authentik SSO session (RP-Initiated Logout) #19

New Issue
Closed
opened 2026-07-13 08:49:13 -06:00 by jhodgkin · 2 comments
jhodgkin commented 2026-07-13 08:49:13 -06:00
Owner
Copy Link
Copy Source

Today, POST /api/auth/logout only destroys this app's own session -- it never touches Authentik's session on auth.jerodrigged.com. Someone who signed in via "Sign in with Authentik", then signs out of the dashboard, is still logged into Authentik itself; clicking the button again silently re-authenticates with no prompt.

Fix is OIDC RP-Initiated Logout: redirect through Authentik's end_session_endpoint (https://auth.jerodrigged.com/application/o/homelab-monitor/end-session/) with id_token_hint + post_logout_redirect_uri, rather than just clearing our local session.

Needs:

  • Store enough of the ID token at login time to pass as id_token_hint at logout (not currently retained past the callback).
  • Register post_logout_redirect_uri as an allowed redirect in the Authentik blueprint (same pattern as the OAuth redirect_uris).
  • Only take this path if the session was actually established via OIDC -- a locally-authenticated session has no Authentik session to end, so plain local logout should stay as-is for that case. Need to track which auth method established the current session.
Today, POST /api/auth/logout only destroys this app's own session -- it never touches Authentik's session on auth.jerodrigged.com. Someone who signed in via "Sign in with Authentik", then signs out of the dashboard, is still logged into Authentik itself; clicking the button again silently re-authenticates with no prompt. Fix is OIDC RP-Initiated Logout: redirect through Authentik's end_session_endpoint (https://auth.jerodrigged.com/application/o/homelab-monitor/end-session/) with id_token_hint + post_logout_redirect_uri, rather than just clearing our local session. Needs: - Store enough of the ID token at login time to pass as id_token_hint at logout (not currently retained past the callback). - Register post_logout_redirect_uri as an allowed redirect in the Authentik blueprint (same pattern as the OAuth redirect_uris). - Only take this path if the session was actually established via OIDC -- a locally-authenticated session has no Authentik session to end, so plain local logout should stay as-is for that case. Need to track which auth method established the current session.
jhodgkin commented 2026-07-13 08:50:58 -06:00
Author
Owner
Copy Link
Copy Source

Starting this one.

Starting this one.
jhodgkin commented 2026-07-13 09:20:04 -06:00
Author
Owner
Copy Link
Copy Source

Follow-up after the initial fix: found and fixed two related bugs during verification.

  1. First RP-Initiated Logout attempt was app-scoped only -- Authentik's default-provider-invalidation-flow ends only this app's session, leaving Authentik's own browser cookie valid, so "Sign in with Authentik" would silently re-authenticate with no prompt. Switched the provider's invalidation_flow to default-invalidation-flow (full logout). Verified via Playwright click-through both ways.

  2. Username field showed a raw session-token-looking hash next to the sign-out button (user-reported). Root cause: the OAuth2Provider had no property_mappings, so the ID token never carried preferred_username/email -- the app's fallback landed on the raw sub hash. Fixed by attaching Authentik's default openid/profile/email scope mappings. No app code change needed.

Also version-controlled the Authentik blueprint at deploy/authentik/homelab-monitor-oidc.yaml (previously only lived on CT121 via ad-hoc scp), and added Playwright regression coverage for both bugs in e2e/tests/oidc-login.spec.ts. Full suite green (16 passed, 1 cleanly skipped -- unrelated device-labeling drift in deep-check.spec.ts). Details in docs/oidc-setup.md.

Follow-up after the initial fix: found and fixed two related bugs during verification. 1. **First RP-Initiated Logout attempt was app-scoped only** -- Authentik's `default-provider-invalidation-flow` ends only this app's session, leaving Authentik's own browser cookie valid, so "Sign in with Authentik" would silently re-authenticate with no prompt. Switched the provider's `invalidation_flow` to `default-invalidation-flow` (full logout). Verified via Playwright click-through both ways. 2. **Username field showed a raw session-token-looking hash next to the sign-out button** (user-reported). Root cause: the OAuth2Provider had no `property_mappings`, so the ID token never carried `preferred_username`/`email` -- the app's fallback landed on the raw `sub` hash. Fixed by attaching Authentik's default openid/profile/email scope mappings. No app code change needed. Also version-controlled the Authentik blueprint at `deploy/authentik/homelab-monitor-oidc.yaml` (previously only lived on CT121 via ad-hoc scp), and added Playwright regression coverage for both bugs in `e2e/tests/oidc-login.spec.ts`. Full suite green (16 passed, 1 cleanly skipped -- unrelated device-labeling drift in `deep-check.spec.ts`). Details in `docs/oidc-setup.md`.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
jhodgkin
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: jhodgkin/homelab-monitor#19
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?