Add support for SSO logout

[danielkelemen]

Acceptance Criteria (Required on creation)

• Implement SSO logout.
• Extend the frontend so that the logout URL can be configured.
• Document the new config.
  • Also add that it should be /logout for Spring Security/oauth2.
• Add a config property that determines if SSO or normal logout is needed.
• Tests. Moved to a separate ticket.

Hints

Links

Breakdown

PRs

Beta Give feedback

1. feat(oauth2): add sso logout support #4604
   ci:run ci:spring-boot +2
   
2. feat(oauth2): improve logging with token name #4638
   +0
   

[tasso94]

Hey @danielkelemen,

I think #4585 is much more important.
Could you have a look at this first?

[danielkelemen]

Spring Security & Webapps logout

Spring Security has a default /logout (configurable) endpoint that takes care of the logout. With SSO logout, this clears the session and redirects to the provider's page for a full logout. Which means this call needs to be a page load, not just an async (AJAX) request.
Right now our Webapps exeute an async logout call, then forwards the user to the login page.

Solution

Create a logout plugin that overrides the default logout button. This can be done in multiple ways:

1. Create a plugin point.
   • Cons: Higher effort.
2. Intercept XHR request for logout and forward to Spring /logout.
   • Cons: Kind of hacky and it results in weird console errors.
3. Listen to URL changes and forward to Spring /logout.
   • Cons: Kind of hacky and it results in multiple redirects which is not nice UX.
4. Replace logout DOM.
   • Cons: Kind of hacky.
   • This seems the best solution. I used the MutationObserver for initialization. Supported in all important browsers.

[danielkelemen]

Dev2QA

SSO logout forwards the user to Okta for full logout then to the postLogoutRedirectUri.
With these properties you can enable SSO logout:

camunda.bpm.oauth2:
  sso-logout:
    enabled: true
    postLogoutRedirectUri: https://camunda.com/

Notes:

• Normal logout shouldn't log out the user from Okta.
  • It still uses the Spring logout, so it will show a Spring logout page.
• After SSO logout the user should be logged out from Camunda & Okta.
• SSO logout should work from all Webapps.
• Should work in both Run & Spring Boot.

[yanavasileva]

It still uses the Spring logout, so it will show a Spring logout page.

That feels weird as I see "You have been signed out" but I am not. But we can improve this later if we get feedback.

[gbetances089]

This was tested on both camunda-bpm-run-ee-7.22.0-20240919.175253-98 and spring boot.