| When the standard authenticator is disabled (oidc.tryLocal=false in xwiki.properties, or "Is standard authenticator allowed?" unchecked in the client configuration), logging out of XWiki does not log the user out of the OpenID Connect provider. Steps to reproduce
- Configure the OIDC authenticator with a provider that has an end session (logout) endpoint
- Set oidc.tryLocal=false
- Log in through the provider
- Click "Log-out" in XWiki
Result The XWiki logout is not detected by the authenticator, so the provider logout request is never sent. The provider session stays active and the user is immediately authenticated again, i.e. they stay logged in. Expected Same behavior as with oidc.tryLocal=true: the user is redirected to the provider logout endpoint and ends up logged out of both XWiki and the provider. Cause When the standard authenticator is disabled, the authenticator used for the request is never initialized with the login, logout and error pages configuration, so it never recognizes the logout URL. |