Implement hydra logout endpoint

[jvinolas]

When doing logout from a client app this is the flow happening:

1. Logout from the app: https://hydra.server/oauth2/sessions/logout
2. Hydra calls mokey: https://mokey.server/auth/logout (with a post_logout_redirect). Here Hydra expects a flow as is setting a logout_challenge parameter on url (as stated in the documentation: https://www.ory.sh/hydra/docs/concepts/logout/)
3. Looking at the code, mokey doesn't follow that flow and seems to just revoke Hydra authentication:

   mokey/server/auth.go

   Line 90 in 04fcefd

   func (h *Handler) Logout(c echo.Context) error {

   and after that just redirects to /auth/login

   mokey/server/auth.go

   Line 99 in 04fcefd

   return c.Redirect(http.StatusFound, Path("/auth/login"))

   but, as it has no login_challenge as when it comes from an app, it will not follow the OpenID flow to the app again.

As stated on hydra documentation, there is a flow and there is a post_logout_redirect_uri where the user should be redirected after logout (and also an optional logout consent page). As I understand mokey should get that post redirect parameter from the logout flow from hydra and in the end redirect there (to the app), so when the user wants to log in again, the app will redirect with the login_challenge parameter from hydra (login flow).

Is the logout flow missing in mokey? Or am I misunderstanding the OpenID logout flow?

[jvinolas]

As a workaround now I just replaced the logout redirect in auth.go to return c.Redirect(http.StatusMovedPermanently, "https://myapp.server") and it works as the app brings back to mokey login with the login_challenge.

[jvinolas]

I've found that my workaround is not working as now when coming from hydra there is no mokey cookie (no sid or user found in session) and then the hydra revoke fails.

[aebruno]

Is the logout flow missing in mokey? Or am I misunderstanding the OpenID logout flow?

Yes, this logout flow is not implemented in mokey. Currently, the logout just revokes the hydra session using the admin api.

[jvinolas]

Any plans to implement it to accomplish OpenID standard with hydra? Thanks