end_session_endpont Needs Be added to .well-known/openid-configuration endpoint #7604

New Issue

2025-11-02T07:31:08-06:00

GiteaMirror commented

2025-11-02 07:31:08 -06:00

Originally created by @vw98075 on GitHub (Jul 19, 2021).

Gitea version (or commit ref): 1.15.0-dev-588-g187468083

Description

Default implementation expects end_session_endpont to be exposed by the IDP .well-known/openid-configuration endpoint. The OOB supported Keycloak and okta do provide the endpoint details in the above metadata API response. Please follow the mainstream and add it to the endpoint. I don't see anything else on user log-off in the current endpoint.
—

...

Screenshots

Originally created by @vw98075 on GitHub (Jul 19, 2021).  - Gitea version (or commit ref): 1.15.0-dev-588-g187468083 ## Description Default implementation expects end_session_endpont to be exposed by the IDP .well-known/openid-configuration endpoint. The OOB supported Keycloak and okta do provide the endpoint details in the above metadata API response. Please follow the mainstream and add it to the endpoint. I don't see anything else on user log-off in the current endpoint. — ... ## Screenshots

GiteaMirror commented

2025-11-02 07:31:08 -06:00

@zeripath commented on GitHub (Jul 20, 2021):

Would it be possible to provide a link to the spec?

@zeripath commented on GitHub (Jul 20, 2021): Would it be possible to provide a link to the spec?

GiteaMirror commented

2025-11-02 07:31:08 -06:00

@vw98075 commented on GitHub (Jul 20, 2021):

In the current Gitea OAuth implementation, is a way to log off a user session on Gitea when a user logs off on its OAuth client?

Some results of online search on end_session_endpont:

https://identityserver4.readthedocs.io/en/latest/endpoints/endsession.html
https://ldapwiki.com/wiki/End_session_endpoint

@vw98075 commented on GitHub (Jul 20, 2021): In the current Gitea OAuth implementation, is a way to log off a user session on Gitea when a user logs off on its OAuth client? Some results of online search on end_session_endpont: https://identityserver4.readthedocs.io/en/latest/endpoints/endsession.html https://ldapwiki.com/wiki/End_session_endpoint

GiteaMirror commented

2025-11-02 07:31:09 -06:00

@KN4CK3R commented on GitHub (Jul 21, 2021):

Here is the (optional) spec:
https://openid.net/specs/openid-connect-rpinitiated-1_0.html
I found only one public OpenID provider (Microsoft) which implements this endpoint.

@KN4CK3R commented on GitHub (Jul 21, 2021): Here is the (optional) spec: https://openid.net/specs/openid-connect-rpinitiated-1_0.html I found only one public OpenID provider (Microsoft) which implements this endpoint.

GiteaMirror commented

2025-11-02 07:31:09 -06:00

@vw98075 commented on GitHub (Jul 21, 2021):

Two major OAuth2 services, Keycloak and Okta, have it in their .well-known/openid-configuration points.

@vw98075 commented on GitHub (Jul 21, 2021): Two major OAuth2 services, Keycloak and Okta, have it in their .well-known/openid-configuration points.

GiteaMirror commented

2025-11-02 07:31:09 -06:00

@zeripath commented on GitHub (Jul 21, 2021):

the end_session_endpoint is only required if we support openid connect session management which AFAICS we don't support

(I'm not saying that we shouldn't or can't but that we don't currently support it.)

@zeripath commented on GitHub (Jul 21, 2021): the end_session_endpoint is only required if we support openid connect session management which AFAICS we don't support (I'm not saying that we shouldn't or can't but that we don't currently support it.)

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#7604