Bug 57516 - OIDC frontchannel logout URL does not set correct iframe headers
Summary: OIDC frontchannel logout URL does not set correct iframe headers
Status: CLOSED FIXED
Alias: None
Product: UCS
Classification: Unclassified
Component: OpenID Connect
Version: UCS 5.0
Hardware: Other Linux
: P5 normal
Target Milestone: UCS 5.0-9-errata
Assignee: Christian Castens
QA Contact: Arvid Requate
URL: https://git.knut.univention.de/univen...
Keywords:
: 57466 (view as bug list)
Depends on:
Blocks:
 
Reported: 2024-08-14 14:22 CEST by Marius Meschter
Modified: 2025-03-21 14:26 CET (History)
4 users (show)

See Also:
What kind of report is it?: Bug Report
What type of bug is this?: 5: Major Usability: Impairs usability in key scenarios
Who will be affected by this bug?: 1: Will affect a very few installed domains
How will those affected feel about the bug?: 3: A User would likely not purchase the product
User Pain: 0.086
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Customer ID:
Max CVSS v3 score:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marius Meschter univentionstaff 2024-08-14 14:22:42 CEST
the /frontchannel-logout URL does not have proper iframe headers. This is an issue if the OP is not at the same URL as the Portal. 

E.g. portal at backup.ucs.test OP at auth.extern.test

During a frontchannel logout auth.extern.test renders and invisible iframe with backup.ucs.test/univention/oidc/frontchannel-logout. However during this request no UMC session ID cookie is sent to backup.ucs.test due to the 'Content-Security-Policy frame-ancestors 'none';' header being present. This will lead to the session not being ended in the UMC.
Comment 2 Christian Castens univentionstaff 2024-10-15 10:32:28 CEST
*** Bug 57466 has been marked as a duplicate of this bug. ***
Comment 3 Christian Castens univentionstaff 2024-10-15 12:56:37 CEST
Successful build
Package: univention-management-console
Version: 12.0.35-5
Branch: 5.0-0
Scope: errata5.0-9


univention-management-console.yaml
34285904d626 | fix (umc, Bug #57516): make OIDC front-channel logout work

univention-management-console (12.0.35-5)
34285904d626 | fix (umc, Bug #57516): make OIDC front-channel logout work

ucs-test (10.0.23-15)
34285904d626 | fix (umc, Bug #57516): make OIDC front-channel logout work


The HTTP Content-Security-Policy frame-ancestors directive was added for the UMC's oidc/frontchannel-logout
endpoint to allow the OpenID Provider to embed it in the hidden iframe which is used during front-channel
logout to navigate back to the RP.

The changes to oidc.py are made because there was a flaw in the implementation of the front-channel logout
flow. Previously the UMC's oidc/frontchannel-logout endpoint made an unnecessary redirect that is now
removed. See Bug #57466 for more information.
Comment 4 Arvid Requate univentionstaff 2024-10-16 12:51:45 CEST
Verified:
* Code review: Ok
* Change for Bug #57466 is included
* Automatic ucs-test keycloak 13_logout.py check now also successfully checks frontend logout
* Manual test of Debian packages on test env with external-fqdn was ok
* Advisory: Ok
* Cherry-picked and built in UCS 5.2: Ok


Package: univention-management-console
Version: 14.0.35
Branch: 5.2-0
Comment 5 Dirk Wiesenthal univentionstaff 2024-10-16 16:38:08 CEST
<https://errata.software-univention.de/#/?erratum=5.0x1144>