fix(login): treat already-logged-out as success in backchannel logout (#1430)#1431
Open
SAY-5 wants to merge 2 commits intonextcloud:mainfrom
Open
fix(login): treat already-logged-out as success in backchannel logout (#1430)#1431SAY-5 wants to merge 2 commits intonextcloud:mainfrom
SAY-5 wants to merge 2 commits intonextcloud:mainfrom
Conversation
Closes nextcloud#1430. OIDC Backchannel Logout 1.0 §2.6 says: 'If the identified End-User is already logged out at the RP when the logout request is received, the logout is considered to have succeeded.' Today `backChannelLogout()` returns HTTP/400 when the (sid, iss) or (sub, iss) lookup yields no matching session, even though that is exactly the already-logged-out case the spec calls out as a *success*. IdPs (e.g. LemonLDAP, Keycloak) surface this 400 to the end user and log a spurious error. The other validation branches in this method — invalid issuer, invalid signature, missing claims, malformed token — keep their HTTP/400 responses. Only the two 'session not found' paths flip to HTTP/200 + a debug log so administrators can still trace what happened. See https://openid.net/specs/openid-connect-backchannel-1_0.html#BCActions Signed-off-by: SAY-5 <say.apm35@gmail.com>
|
Thanks ! |
julien-nc
requested changes
Apr 29, 2026
Member
julien-nc
left a comment
julien-nc
left a comment
There was a problem hiding this comment.
Thanks a lot. Small adjustments and let's get this in!
| // out is a success). Same rationale as the (sid,iss) | ||
| // branch above. | ||
| $this->logger->debug( | ||
| '[BackchannelLogout] no RP sessions for (sub,iss) — treating as already-logged-out per spec', |
Member
There was a problem hiding this comment.
Suggested change
| '[BackchannelLogout] no RP sessions for (sub,iss) — treating as already-logged-out per spec', | |
| '[BackchannelLogout] no RP sessions for (sub,iss) — treating as already-logged-out', |
| // state — the RP session being gone — is already true. | ||
| // See https://openid.net/specs/openid-connect-backchannel-1_0.html#BCActions | ||
| $this->logger->debug( | ||
| '[BackchannelLogout] no RP session for (sid,iss) — treating as already-logged-out per spec', |
Member
There was a problem hiding this comment.
Suggested change
| '[BackchannelLogout] no RP session for (sid,iss) — treating as already-logged-out per spec', | |
| '[BackchannelLogout] no RP session for (sid,iss) — treating as already-logged-out', |
Comment on lines
+933
to
+940
| // Per OIDC Backchannel Logout 1.0 §2.6: | ||
| // "If the identified End-User is already logged out at the | ||
| // RP when the logout request is received, the logout is | ||
| // considered to have succeeded." Returning 400 here | ||
| // causes IdPs (e.g. LemonLDAP, Keycloak) to surface a | ||
| // confusing error to the user even though the desired | ||
| // state — the RP session being gone — is already true. | ||
| // See https://openid.net/specs/openid-connect-backchannel-1_0.html#BCActions |
Member
There was a problem hiding this comment.
Can you make this a little bit shorter? The link + a very brief explanation should be enough.
SAY-5
added a commit
to SAY-5/user_oidc
that referenced
this pull request
Apr 29, 2026
Address julien-nc's review:
- Shorten the long rationale comment to a one-liner with the spec
link, per inline review at lib/Controller/LoginController.php:940.
- Drop the redundant ' per spec' suffix from both already-logged-out
debug log lines (lib/Controller/LoginController.php:942 and :972),
matching the suggested edits.
Behaviour is unchanged — only comment / log message wording.
Author
|
Thanks for the review @julien-nc — applied all three suggestions in aa87b8f: comment block shortened to a single line + spec link, and the redundant |
julien-nc
approved these changes
Apr 29, 2026
Member
|
Thanks for the adjustments. Could you sign your commits like indicated in the DCO check output? |
Address julien-nc's review:
- Shorten the long rationale comment to a one-liner with the spec
link, per inline review at lib/Controller/LoginController.php:940.
- Drop the redundant ' per spec' suffix from both already-logged-out
debug log lines (lib/Controller/LoginController.php:942 and :972),
matching the suggested edits.
Behaviour is unchanged — only comment / log message wording.
Signed-off-by: SAY-5 <say.apm35@gmail.com>
SAY-5
force-pushed
the
fix/backchannel-logout-already-logged-out-1430
branch
from
aa87b8f to
abe6772
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1430.
Summary
Per OIDC Backchannel Logout 1.0 §2.6:
Today
backChannelLogout()returns HTTP/400 when the(sid, iss)or(sub, iss)lookup yields no matching session, which is exactly the already-logged-out case the spec calls out as a success. The reporter (running LemonLDAP) sees a confusing error surfaced on the IdP UI even though the desired state — the RP session being gone — is already true. The same shape would happen with Keycloak, Authelia, etc.Change
Only the two "session not found" paths flip to HTTP/200:
findSessionBySid→DoesNotExistException⇒ returnHTTP/200 OK+ debug log.findSessionsBySubAndIssreturns empty ⇒ returnHTTP/200 OK+ debug log.The other validation branches in the same method — invalid issuer, invalid signature, malformed token, missing claims, multiple-sessions-found — keep their HTTP/400 responses. Operators that need visibility into already-logged-out backchannel calls can flip Nextcloud's
logleveltodebugand see the[BackchannelLogout]line.Mirrors the proposed fix in the issue and the spec citation.
Test plan
LoginControllerTestexists intests/unit/Controller/today, and the existing integration runner undertests/integration/does not cover the backchannel flow. The change is two short branches that swap agetBackchannelLogoutErrorResponse()fornew JSONResponse([], Http::STATUS_OK)plus a debug log; both branches are syntactically equivalent to the existingreturn new JSONResponse([], Http::STATUS_OK)at the end of the success path.git diff --checkclean.Notes