10000 OpenID connect plugin Front-channel Logout URL is not working in Moodle 4.5 · Issue #2705 · microsoft/o365-moodle · GitHub
[go: up one dir, main page]
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

OpenID connect plugin Front-channel Logout URL is not working in Moodle 4.5 #2705

Open
sarath-sarangadharan opened this issue Nov 26, 2024 · 1 comment · May be fixed by #2715, #2712, #2713 or #2714
Open

OpenID connect plugin Front-channel Logout URL is not working in Moodle 4.5 #2705

sarath-sarangadharan opened this issue Nov 26, 2024 · 1 comment · May be fixed by #2715, #2712, #2713 or #2714
Assignees
@weilai-irl
Labels
Feature - SSO Issue type - bug Bugs in existing code that needs to be fixed. Plugin - auth_oidc Status - PR ready / pending release Dev is done and PR ready. Will be included in the next release.
Milestone
2025-01

Comments

@sarath-sarangadharan
Copy link

I have configured OpenID connect plugin in my moodle site. Also had set "PostLogoutUris": [ "/auth/oidc/logout.php" ], in appsettings for single sign out. But when I log out from extremal site( developed in .net) which is using same SSO, moodle site is not getting logged out.
Any suggestions?

I am a dot net developer. Not much experience in PHP .
@sarath-sarangadharan sarath-sarangadharan changed the title OpenID connect plugin Front-channel Logout URL is not working. OpenID connect plugin Front-channel Logout URL is not working in Moodle Nov 26, 2024
@sarath-sarangadharan sarath-sarangadharan changed the title OpenID connect plugin Front-channel Logout URL is not working in Moodle OpenID connect plugin Front-channel Logout URL is not working in Moodle 4.5 Nov 26, 2024
@weilai-irl weilai-irl self-assigned this Jan 31, 2025
@weilai-irl weilai-irl added this to the 2025-01 milestone Jan 31, 2025
This was linked to pull requests Jan 31, 2025
Handle front-channel logout URL visits from multiple user sessions #2715
Open
Handle front-channel logout URL visits from multiple user sessions #2712
Open
Handle front-channel logout URL visits from multiple user sessions #2713
Open
Handle front-channel logout URL visits from multiple user sessions #2714
Open
@weilai-irl weilai-irl added Issue type - bug Bugs in existing code that needs to be fixed. Plugin - auth_oidc Status - PR ready / pending release Dev is done and PR ready. Will be included in the next release. Feature - SSO labels Jan 31, 2025
@weilai-irl
Copy link
Collaborator

Hi @sarath-sarangadharan

After some investigation, we concluded that what you want to achieve is not how front-channel logout URL is designed for.

In short, when a Microsoft user logs out from the Microsoft account, Entra ID does not trigger a request to all the front-channel logout URLs configured in all Azure apps in the tenant. Instead, it will only call the front-channel logout URL from the user session where the logout action is initiated.

Consider this scenario:

  1. A user logs in to Moodle in browser session 1 using auth_oidc.
  2. The same user logs in to Moodle in browser session 2 using auth_oidc. This could be in a different computer, a different browser, a different browser profile, or a private window.
  3. The Microsoft account is logged in in another browser session (or application), where there is no Moodle login in this session.
  4. If the user logs out of the Microsoft account from browser session 3, the user would still be logged in to Moodle (and Microsoft account) in browser session 1 and 2.
  5. If the user logs out of the Microsoft account from browser session 1, then the user will be logged out of Moodle in browser session 1; but the user would still be logged in to Moodle (and Microsoft account) in browser session 2.

We did find a related bug while investigating this issue, in which Moodle only stores the sid from the latest login. As a result, in step 5 of the scenario above, Moodle user logout would work if the user logs out of Microsoft from browser session 2, but it wouldn't work for browser session 1 because the sid would have been overwritten. A solution has been provided in the PR linked to this issue.

Regards,
Lai

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@weilai-irl weilai-irl

Labels
Feature - SSO Issue type - bug Bugs in existing code that needs to be fixed. Plugin - auth_oidc Status - PR ready / pending release Dev is done and PR ready. Will be included in the next release.
Projects
None yet
Milestone
2025-01
2 participants
@weilai-irl @sarath-sarangadharan
0