feat(oauth2): add sso logout support

spring-boot-starter/starter-security/src/main/java/org/camunda/bpm/spring/boot/starter/security/oauth2/CamundaSpringSecurityOAuth2AutoConfiguration.java

@@ -16,6 +16,7 @@
  */
 package org.camunda.bpm.spring.boot.starter.security.oauth2;
 
+import jakarta.annotation.Nullable;
 import jakarta.servlet.DispatcherType;
 import jakarta.servlet.Filter;
 import org.camunda.bpm.engine.rest.security.auth.ProcessEngineAuthenticationFilter;
@@ -27,6 +28,7 @@
 import org.camunda.bpm.spring.boot.starter.security.oauth2.impl.OAuth2AuthenticationProvider;
 import org.camunda.bpm.spring.boot.starter.security.oauth2.impl.OAuth2GrantedAuthoritiesMapper;
 import org.camunda.bpm.spring.boot.starter.security.oauth2.impl.OAuth2IdentityProviderPlugin;
+import org.camunda.bpm.spring.boot.starter.security.oauth2.impl.SsoLogoutSuccessHandler;
 import org.camunda.bpm.webapp.impl.security.auth.ContainerBasedAuthenticationFilter;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -46,6 +48,7 @@
 import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
 import org.springframework.security.core.authority.mapping.GrantedAuthoritiesMapper;
 import org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager;
+import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
 import org.springframework.security.oauth2.client.web.OAuth2AuthorizationRequestRedirectFilter;
 import org.springframework.security.web.SecurityFilterChain;
 
@@ -85,7 +88,7 @@ public FilterRegistrationBean<?> webappAuthenticationFilter() {
   }
 
   @Bean
-  @ConditionalOnProperty(name = "identity-provider.enabled", prefix = OAuth2Properties.PREFIX)
+  @ConditionalOnProperty(name = "identity-provider.enabled", havingValue = "true", prefix = OAuth2Properties.PREFIX)
   public OAuth2IdentityProviderPlugin identityProviderPlugin() {
     logger.debug("Registering OAuth2IdentityProviderPlugin");
     return new OAuth2IdentityProviderPlugin();
@@ -99,27 +102,48 @@ protected GrantedAuthoritiesMapper grantedAuthoritiesMapper() {
   }
 
   @Bean
-  public SecurityFilterChain filterChain(HttpSecurity http, OAuth2AuthorizedClientManager clientManager)
-      throws Exception {
-    logger.info("Enabling Camunda Spring Security oauth2 integration");
+  @ConditionalOnProperty(name = "sso-logout.enabled", havingValue = "true", prefix = OAuth2Properties.PREFIX)
+  protected SsoLogoutSuccessHandler ssoLogoutSuccessHandler(ClientRegistrationRepository clientRegistrationRepository) {
+    logger.debug("Registering SsoLogoutSuccessHandler");
+    return new SsoLogoutSuccessHandler(clientRegistrationRepository, oAuth2Properties);
+  }
+
+  @Bean
+  protected AuthorizeTokenFilter authorizeTokenFilter(OAuth2AuthorizedClientManager clientManager) {
+    logger.debug("Registering AuthorizeTokenFilter");
+    return new AuthorizeTokenFilter(clientManager);
+  }
 
-    var validateTokenFilter = new AuthorizeTokenFilter(clientManager);
+  @Bean
+  public SecurityFilterChain filterChain(HttpSecurity http,
+                                         AuthorizeTokenFilter authorizeTokenFilter,
+                                         @Nullable SsoLogoutSuccessHandler ssoLogoutSuccessHandler) throws Exception {
+
+    logger.info("Enabling Camunda Spring Security oauth2 integration");
 
     // @formatter:off
     http.authorizeHttpRequests(c -> c
             .requestMatchers(webappPath + "/app/**").authenticated()
             .requestMatchers(webappPath + "/api/**").authenticated()
             .anyRequest().permitAll()
         )
-        .addFilterAfter(validateTokenFilter, OAuth2AuthorizationRequestRedirectFilter.class)
+        .addFilterAfter(authorizeTokenFilter, OAuth2AuthorizationRequestRedirectFilter.class)
         .anonymous(AbstractHttpConfigurer::disable)
+        .oidcLogout(c -> c.backChannel(Customizer.withDefaults()))
         .oauth2Login(Customizer.withDefaults())
-        .oidcLogout(Customizer.withDefaults())
+        .logout(c -> c
+            .clearAuthentication(true)
+            .invalidateHttpSession(true)
+        )
         .oauth2Client(Customizer.withDefaults())
         .cors(AbstractHttpConfigurer::disable)
         .csrf(AbstractHttpConfigurer::disable);
     // @formatter:on
 
+    if (oAuth2Properties.getSsoLogout().isEnabled()) {
+      http.logout(c -> c.logoutSuccessHandler(ssoLogoutSuccessHandler));
+    }
+
     return http.build();
   }
 

spring-boot-starter/starter-security/src/main/java/org/camunda/bpm/spring/boot/starter/security/oauth2/OAuth2Properties.java

@@ -16,19 +16,55 @@
  */
 package org.camunda.bpm.spring.boot.starter.security.oauth2;
 
-import org.camunda.bpm.spring.boot.starter.security.oauth2.impl.OAuth2IdentityProvider;
 import org.camunda.bpm.spring.boot.starter.property.CamundaBpmProperties;
+import org.camunda.bpm.spring.boot.starter.security.oauth2.impl.OAuth2IdentityProvider;
 import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.boot.context.properties.NestedConfigurationProperty;
 
 @ConfigurationProperties(OAuth2Properties.PREFIX)
 public class OAuth2Properties {
 
   public static final String PREFIX = CamundaBpmProperties.PREFIX + ".oauth2";
 
+  /**
+   * OAuth2 SSO logout properties.
+   */
+  @NestedConfigurationProperty
+  private OAuth2SSOLogoutProperties ssoLogout = new OAuth2SSOLogoutProperties();
+
   /**
    * OAuth2 identity provider properties.
    */
-  private OAuth2IdentityProviderProperties identityProvider;
+  @NestedConfigurationProperty
+  private OAuth2IdentityProviderProperties identityProvider = new OAuth2IdentityProviderProperties();
+
+  public static class OAuth2SSOLogoutProperties {
+    /**
+     * Enable SSO Logout. Default {@code false}.
+     */
+    private boolean enabled = false;
+
+    /**
+     * Enable SSO Logout. Default {@code {baseUrl}}.
+     */
+    private String postLogoutRedirectUri = "{baseUrl}";
+
+    public boolean isEnabled() {
+      return enabled;
+    }
+
+    public void setEnabled(boolean enabled) {
+      this.enabled = enabled;
+    }
+
+    public String getPostLogoutRedirectUri() {
+      return postLogoutRedirectUri;
+    }
+
+    public void setPostLogoutRedirectUri(String postLogoutRedirectUri) {
+      this.postLogoutRedirectUri = postLogoutRedirectUri;
+    }
+  }
 
   public static class OAuth2IdentityProviderProperties {
     /**
@@ -71,6 +107,14 @@ public void setGroupNameDelimiter(String groupNameDelimiter) {
     }
   }
 
+  public OAuth2SSOLogoutProperties getSsoLogout() {
+    return ssoLogout;
+  }
+
+  public void setSsoLogout(OAuth2SSOLogoutProperties ssoLogout) {
+    this.ssoLogout = ssoLogout;
+  }
+
   public OAuth2IdentityProviderProperties getIdentityProvider() {
     return identityProvider;
   }

spring-boot-starter/starter-security/src/main/java/org/camunda/bpm/spring/boot/starter/security/oauth2/impl/SsoLogoutSuccessHandler.java

@@ -0,0 +1,46 @@
+/*
+ * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH
+ * under one or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information regarding copyright
+ * ownership. Camunda licenses this file to you under the Apache License,
+ * Version 2.0; you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.camunda.bpm.spring.boot.starter.security.oauth2.impl;
+
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import org.camunda.bpm.spring.boot.starter.security.oauth2.OAuth2Properties;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.oauth2.client.oidc.web.logout.OidcClientInitiatedLogoutSuccessHandler;
+import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
+
+import java.io.IOException;
+
+/**
+ * {@link OidcClientInitiatedLogoutSuccessHandler} with logging.
+ */
+public class SsoLogoutSuccessHandler extends OidcClientInitiatedLogoutSuccessHandler {
+
+  public SsoLogoutSuccessHandler(ClientRegistrationRepository clientRegistrationRepository,
+                                 OAuth2Properties oAuth2Properties) {
+    super(clientRegistrationRepository);
+    this.setPostLogoutRedirectUri(oAuth2Properties.getSsoLogout().getPostLogoutRedirectUri());
+  }
+
+  @Override
+  public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication)
+      throws IOException, ServletException {
+    logger.debug("Initiating SSO logout with provider.");
+    super.onLogoutSuccess(request, response, authentication);
+  }
+}

spring-boot-starter/starter-security/src/main/java/org/camunda/bpm/spring/boot/starter/security/oauth2/impl/plugin/SsoLogoutPluginConstants.java

@@ -0,0 +1,23 @@
+/*
+ * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH
+ * under one or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information regarding copyright
+ * ownership. Camunda licenses this file to you under the Apache License,
+ * Version 2.0; you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.camunda.bpm.spring.boot.starter.security.oauth2.impl.plugin;
+
+public class SsoLogoutPluginConstants {
+
+  public static final String ID = "sso-logout-plugin";
+
+}

spring-boot-starter/starter-security/src/main/java/org/camunda/bpm/spring/boot/starter/security/oauth2/impl/plugin/admin/SsoLogoutAdminPlugin.java

@@ -0,0 +1,36 @@
+/*
+ * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH
+ * under one or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information regarding copyright
+ * ownership. Camunda licenses this file to you under the Apache License,
+ * Version 2.0; you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.camunda.bpm.spring.boot.starter.security.oauth2.impl.plugin.admin;
+
+import org.camunda.bpm.admin.plugin.spi.impl.AbstractAdminPlugin;
+import org.camunda.bpm.spring.boot.starter.security.oauth2.impl.plugin.SsoLogoutPluginConstants;
+
+import java.util.Set;
+
+public class SsoLogoutAdminPlugin extends AbstractAdminPlugin {
+
+  @Override
+  public Set<Class<?>> getResourceClasses() {
+    return Set.of(SsoLogoutAdminPluginRootResource.class);
+  }
+
+  @Override
+  public String getId() {
+    return SsoLogoutPluginConstants.ID;
+  }
+
+}

spring-boot-starter/starter-security/src/main/java/org/camunda/bpm/spring/boot/starter/security/oauth2/impl/plugin/admin/SsoLogoutAdminPluginRootResource.java

@@ -0,0 +1,30 @@
+/*
+ * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH
+ * under one or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information regarding copyright
+ * ownership. Camunda licenses this file to you under the Apache License,
+ * Version 2.0; you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.camunda.bpm.spring.boot.starter.security.oauth2.impl.plugin.admin;
+
+import jakarta.ws.rs.Path;
+import org.camunda.bpm.admin.resource.AbstractAdminPluginRootResource;
+import org.camunda.bpm.spring.boot.starter.security.oauth2.impl.plugin.SsoLogoutPluginConstants;
+
+@Path("plugin/" + SsoLogoutPluginConstants.ID)
+public class SsoLogoutAdminPluginRootResource extends AbstractAdminPluginRootResource {
+
+  public SsoLogoutAdminPluginRootResource() {
+    super(SsoLogoutPluginConstants.ID);
+  }
+
+}

spring-boot-starter/starter-security/src/main/java/org/camunda/bpm/spring/boot/starter/security/oauth2/impl/plugin/cockpit/SsoLogoutCockpitPlugin.java

@@ -0,0 +1,36 @@
+/*
+ * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH
+ * under one or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information regarding copyright
+ * ownership. Camunda licenses this file to you under the Apache License,
+ * Version 2.0; you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.camunda.bpm.spring.boot.starter.security.oauth2.impl.plugin.cockpit;
+
+import org.camunda.bpm.cockpit.plugin.spi.impl.AbstractCockpitPlugin;
+import org.camunda.bpm.spring.boot.starter.security.oauth2.impl.plugin.SsoLogoutPluginConstants;
+
+import java.util.Set;
+
+public class SsoLogoutCockpitPlugin extends AbstractCockpitPlugin {
+
+  @Override
+  public Set<Class<?>> getResourceClasses() {
+    return Set.of(SsoLogoutCockpitPluginRootResource.class);
+  }
+
+  @Override
+  public String getId() {
+    return SsoLogoutPluginConstants.ID;
+  }
+
+}

spring-boot-starter/starter-security/src/main/java/org/camunda/bpm/spring/boot/starter/security/oauth2/impl/plugin/cockpit/SsoLogoutCockpitPluginRootResource.java

@@ -0,0 +1,30 @@
+/*
+ * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH
+ * under one or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information regarding copyright
+ * ownership. Camunda licenses this file to you under the Apache License,
+ * Version 2.0; you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.camunda.bpm.spring.boot.starter.security.oauth2.impl.plugin.cockpit;
+
+import jakarta.ws.rs.Path;
+import org.camunda.bpm.cockpit.plugin.resource.AbstractCockpitPluginRootResource;
+import org.camunda.bpm.spring.boot.starter.security.oauth2.impl.plugin.SsoLogoutPluginConstants;
+
+@Path("plugin/" + SsoLogoutPluginConstants.ID)
+public class SsoLogoutCockpitPluginRootResource extends AbstractCockpitPluginRootResource {
+
+  public SsoLogoutCockpitPluginRootResource() {
+    super(SsoLogoutPluginConstants.ID);
+  }
+
+}