This issue has been created
There are 3 updates.
 
 
OpenId Connect / cid:jira-generated-image-avatar-33f5ebd5-597e-4202-ba86-05aae4656c2e OIDC-324 In Progress

Logout does not log out from the provider when the standard authenticator is disabled

 
View issue   ยท   Add comment
 

Issue created

 
cid:jira-generated-image-avatar-a3c2b703-d54a-4f14-a506-9e10ff93b30b Thomas Mortagne created this issue on 21/Oct/26 08:47
 
Summary: Logout does not log out from the provider when the standard authenticator is disabled
Issue Type: cid:jira-generated-image-avatar-33f5ebd5-597e-4202-ba86-05aae4656c2e Bug
Affects Versions: 2.24.0
Assignee: Unassigned
Components: Authenticator
Created: 21/Oct/26 08:47
Priority: cid:jira-generated-image-static-major-70a839bc-4e16-4259-83fa-128deba357f4 Major
Reporter: Thomas Mortagne
Description:

When the standard authenticator is disabled (oidc.tryLocal=false in xwiki.properties, or "Is standard authenticator allowed?" unchecked in the client configuration), logging out of XWiki does not log the user out of the OpenID Connect provider.

Steps to reproduce

  1. Configure the OIDC authenticator with a provider that has an end session (logout) endpoint
  2. Set oidc.tryLocal=false
  3. Log in through the provider
  4. Click "Log-out" in XWiki

Result

The XWiki logout is not detected by the authenticator, so the provider logout request is never sent. The provider session stays active and the user is immediately authenticated again, i.e. they stay logged in.

Expected

Same behavior as with oidc.tryLocal=true: the user is redirected to the provider logout endpoint and ends up logged out of both XWiki and the provider.

Cause

When the standard authenticator is disabled, the authenticator used for the request is never initialized with the login, logout and error pages configuration, so it never recognizes the logout URL.

 
 

3 updates

 
cid:jira-generated-image-avatar-a3c2b703-d54a-4f14-a506-9e10ff93b30b Changes by Thomas Mortagne on 21/Oct/26 08:47
 
Fix Version: 2.29.1
Assignee: Thomas Mortagne
Status: Open In Progress