Bug 57518 - univention-keycloak oidc/rp create --no-frontchannel-logout does the opposite
Summary: univention-keycloak oidc/rp create --no-frontchannel-logout does the opposite
Status: CLOSED FIXED
Alias: None
Product: UCS
Classification: Unclassified
Component: Keycloak
Version: UCS 5.2
Hardware: Other Linux
: P5 normal
Target Milestone: UCS 5.0-8-errata
Assignee: Dirk Wiesenthal
QA Contact: Julia Bremer
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-08-15 10:43 CEST by Dirk Wiesenthal
Modified: 2024-08-28 15:29 CEST (History)
2 users (show)

See Also:
What kind of report is it?: Bug Report
What type of bug is this?: 3: Simply Wrong: The implementation doesn't match the docu
Who will be affected by this bug?: 2: Will only affect a few installed domains
How will those affected feel about the bug?: 2: A Pain – users won’t like this once they notice it
User Pain: 0.069
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Customer ID:
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Dirk Wiesenthal univentionstaff 2024-08-15 10:43:11 CEST 
--no-frontchannel-logout in fact ACTIVATES the frontchannel logout. Not specifying it deactivates it.

We should change it, even though it changes the behaviour of existing scripts. It is just plain wrong and everyone who specifies the option expects it to turn off frontchannel logout.

We need to keep in mind the places where we use oidc/rp create:

* UMC (joinscript in the product)
* ownCloud (migration guide)
Comment 3 Julia Bremer univentionstaff 2024-08-27 12:19:25 CEST 
OK: --no-frontchannel-logout does what it is supposed to do
OK: Owncloud installation & setup with oidc
OK: UMC oidc configuration
~OK: Tests (upgrade test fails, because we ommitted fixing already falsely created clients, but that is ok for now)
OK: YAML
Verified