CODEWITHSUNDEEP
springspring-authorization-server
Peter Penzov
Peter Penzov

Reputation: 1680

Set end_session_endpoint for logout endpoint

I use Spring Authorization Server 1.4.0 with React Client. By default I have end_session_endpoint param set to "end_session_endpoint":"http://host/connect/logout" in http://host/.well-known/openid-configuration

I need to set it to "end_session_endpoint":"http://host/logout".

I tried to add into SecurityFilterChain:

            .logout(logout -> logout
                    .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
                    .addLogoutHandler(new SecurityContextLogoutHandler())
                    .logoutSuccessUrl("/")
            );

But it's not working. Do you know what is the proper way to override this param?

Upvotes: 0

Views: 82

Answers (1)

Angelo Immediata
Angelo Immediata

Reputation: 6954

In my previous project I configured in this way (I put only the main code)

  @Bean
  @Order(Ordered.HIGHEST_PRECEDENCE)
  public SecurityFilterChain authorizationServerSecurityFilterChain(
      HttpSecurity http, OAuthAuthorizationService authorizationService) throws Exception {
    OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
    http.getConfigurer(OAuth2AuthorizationServerConfigurer.class)
        .oidc(
            oidc ->
                oidc.providerConfigurationEndpoint(
                    providerConfigurationEndpoint ->
                        providerConfigurationEndpoint.providerConfigurationCustomizer(
                            providerConfigurationCustomizer -> {
                              AuthorizationServerContext authorizationServerContext =
                                  AuthorizationServerContextHolder.getContext();
                              String issuer = authorizationServerContext.getIssuer();
                              providerConfigurationCustomizer.claim(
                                  "backchannel_logout_session_supported", "true");
                              providerConfigurationCustomizer.claim(
                                  "end_session_endpoint",
                                  UriComponentsBuilder.fromUriString(issuer)
                                      .path("/logout")
                                      .build()
                                      .toUriString());
                              /*providerConfigurationCustomizer.claim(
                                  "check_session_iframe",
                                  UriComponentsBuilder.fromUriString(issuer)
                                      .path("/checksession/check")
                                      .build()
                                      .toUriString());*/
                              List<String> scopes = new ArrayList<>();
                              scopes.add("openid");
                              scopes.add("address");
                              scopes.add("phone");
                              scopes.add("profile");
                              scopes.add("email");
                              providerConfigurationCustomizer.claim("scopes_supported", scopes);
                            })))
        .authorizationService(authorizationService)

Upvotes: 1

Related Questions