Description Marius Meschter 2024-07-25 10:21:33 CEST

In the UMC OIDC implementation the logout is not correctly implemented. 
After an RP initiated logout, the post_logout_redirect_uri points to the /oidc/logout-done endpoint which then performs the final logout steps. However this is not what this post_logout_redirect_uri should be used for. After a redirect to the OP by the RP the User will optionally confirm the logout at the OP. 
When it has done this the OP will do a frontchannel/backchannel logout at the RPs. This is the point at which the actual logout takes place at the UMC, either through frontchannel or backchannel logout. The UMC supports both so it's up to the OP to decide. Optionally, according to the spec, the actual logout can also occur before the redirection to the OP.
Freeing up the 'post_logout_redirect_uri' would mean that it can be freed to be configured by the Admin.