Logging out does not log out from OIDC provider

[Brice Clocher]

Issue

Impacted version: 4.38.4

Deployment mode: Docker container behind Nginx, Keycloak as OIDC provider.

Problem description:
I'm generally very happy with the way GitBucket handles OpenID Connect sign-in. I followed the documentation to set up integration with Keycloak and everything works fine.

However, once an OIDC user has signed in, logging out of GitBucket does not seem to log out the user out of single-sign on. So by clicking "sign in with OpenID Connect" again, the user is automatically logged in GitBucket again.

To clarify, the steps are:

1. Log in GitBucket using OIDC
2. The OIDC provider asks for credentials. Enter them.
3. User is now logged in GitBucket. Log out user out of GitBucket.
4. Log in GitBucket again using OIDC
5. User is now logged in GitBucket without being asked for credentials.

I'm not sure if this is common practice in the SSO/OIDC world, but I expected the user to be asked for credentials the second time too. Is this behaviour on purpose?

[Naoki Takezoe]

Hm, GitBucket's sign-out action might have to redirect to the logout endpoint if the user has been signed-in with OpenID connect?
https://openid.net/specs/openid-connect-rpinitiated-1_0.html

[Naoki Takezoe]

Created a pull request #3219 to fix this issue, but this hasn't been tested yet so I'm not confident whether or not this fix is valid.

[Brice Clocher]

Awesome, I will test and report back asap.

[Naoki Takezoe]

I tested this with Keycloak and it seems to work as expected.