mirror of
https://github.com/discourse/discourse.git
synced 2025-05-28 23:49:34 +08:00
FEATURE: Add logout functionality to SSO Provider protocol (#8816)
This commit adds support for an optional "logout" parameter in the payload of the /session/sso_provider endpoint. If an SSO Consumer adds a "logout=true" parameter to the encoded/signed "sso" payload, then Discourse will treat the request as a logout request instead of an authentication request. The logout flow works something like this: * User requests logout at SSO-Consumer site (e.g., clicks "Log me out!" on web browser). * SSO-Consumer site does whatever it does to destroy User's session on the SSO-Consumer site. * SSO-Consumer then redirects browser to the Discourse sso_provider endpoint, with a signed request bearing "logout=true" in addition to the usual nonce and the "return_sso_url". * Discourse destroys User's discourse session and redirects browser back to the "return_sso_url". * SSO-Consumer site does whatever it does --- notably, it cannot request SSO credentials from Discourse without the User being prompted to login again.
This commit is contained in:
@ -1105,6 +1105,32 @@ RSpec.describe SessionController do
|
||||
expect(sso2.profile_background_url).to start_with(SiteSetting.s3_cdn_url)
|
||||
expect(sso2.card_background_url).to start_with(SiteSetting.s3_cdn_url)
|
||||
end
|
||||
|
||||
it "successfully logs out and redirects user to return_sso_url when the user is logged in" do
|
||||
sign_in(@user)
|
||||
|
||||
@sso.logout = true
|
||||
get "/session/sso_provider", params: Rack::Utils.parse_query(@sso.payload("secretForOverRainbow"))
|
||||
|
||||
location = response.header["Location"]
|
||||
expect(location).to match(/^http:\/\/somewhere.over.rainbow\/sso$/)
|
||||
|
||||
expect(response.status).to eq(302)
|
||||
expect(session[:current_user_id]).to be_blank
|
||||
expect(response.cookies["_t"]).to be_blank
|
||||
end
|
||||
|
||||
it "successfully logs out and redirects user to return_sso_url when the user is not logged in" do
|
||||
@sso.logout = true
|
||||
get "/session/sso_provider", params: Rack::Utils.parse_query(@sso.payload("secretForOverRainbow"))
|
||||
|
||||
location = response.header["Location"]
|
||||
expect(location).to match(/^http:\/\/somewhere.over.rainbow\/sso$/)
|
||||
|
||||
expect(response.status).to eq(302)
|
||||
expect(session[:current_user_id]).to be_blank
|
||||
expect(response.cookies["_t"]).to be_blank
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
|
Reference in New Issue
Block a user