feat(api): expose post_logout_redirect_uris over gRPC

Added to Client, ClientInfo and UpdateClientReq, alongside the back-channel
logout URI. Without it the API could register where dex pushes a logout
token but not where the browser is allowed to land afterwards, so a client
created through the API could never complete an RP-initiated logout.

Unlike backchannel_logout_uri this needs no explicit presence: a repeated
field already distinguishes an absent list from an empty one, so sending an
empty list clears the URIs.

The example app's admin page grows the field on the create and edit forms
and on the client detail view.

Signed-off-by: maksim.nabokikh <max.nabokih@gmail.com>

Author: nabokihms

api/v2/api.pb.go

@@ -20,6 +20,9 @@ message Client {
   // ends, per OIDC Back-Channel Logout 1.0. Empty means the client is not
   // notified.
   string backchannel_logout_uri = 10;
+  // Where the browser may be sent after an RP-initiated logout. A
+  // post_logout_redirect_uri that is not listed here is refused.
+  repeated string post_logout_redirect_uris = 11;
 }
 
 // ClientInfo represents an OAuth2 client without sensitive information.
@@ -33,6 +36,7 @@ message ClientInfo {
   repeated string allowed_connectors = 7;
   repeated string sso_shared_with = 8;
   string backchannel_logout_uri = 9;
+  repeated string post_logout_redirect_uris = 10;
 }
 
 // GetClientReq is a request to retrieve client details.
@@ -81,6 +85,7 @@ message UpdateClientReq {
     // a client could be given a back-channel endpoint but never relieved of one,
     // leaving dex posting logout tokens at something that no longer exists.
     optional string backchannel_logout_uri = 8;
+    repeated string post_logout_redirect_uris = 9;
 }
 
 // UpdateClientResp returns the response from updating a client.

api/v2/api.proto

@@ -156,15 +156,16 @@ func (s *Server) handleAdmin(w http.ResponseWriter, r *http.Request) {
 		if resp, err := s.admin.api.ListClients(ctx, &api.ListClientReq{}); err == nil {
 			for _, c := range resp.Clients {
 				data.Clients = append(data.Clients, AdminClient{
-					ID:                   c.Id,
-					Name:                 c.Name,
-					RedirectURIs:         c.RedirectUris,
-					TrustedPeers:         c.TrustedPeers,
-					Public:               c.Public,
-					LogoURL:              c.LogoUrl,
-					AllowedConnectors:    c.AllowedConnectors,
-					SSOSharedWith:        c.SsoSharedWith,
-					BackchannelLogoutURI: c.BackchannelLogoutUri,
+					ID:                     c.Id,
+					Name:                   c.Name,
+					RedirectURIs:           c.RedirectUris,
+					TrustedPeers:           c.TrustedPeers,
+					Public:                 c.Public,
+					LogoURL:                c.LogoUrl,
+					AllowedConnectors:      c.AllowedConnectors,
+					SSOSharedWith:          c.SsoSharedWith,
+					BackchannelLogoutURI:   c.BackchannelLogoutUri,
+					PostLogoutRedirectURIs: c.PostLogoutRedirectUris,
 				})
 			}
 		} else {
@@ -268,15 +269,16 @@ func (s *Server) handleAdmin(w http.ResponseWriter, r *http.Request) {
 		if resp, err := s.admin.api.GetClient(ctx, &api.GetClientReq{Id: id}); err == nil && resp.Client != nil {
 			c := resp.Client
 			data.EditClient = &AdminClient{
-				ID:                   c.Id,
-				Name:                 c.Name,
-				RedirectURIs:         c.RedirectUris,
-				TrustedPeers:         c.TrustedPeers,
-				Public:               c.Public,
-				LogoURL:              c.LogoUrl,
-				AllowedConnectors:    c.AllowedConnectors,
-				SSOSharedWith:        c.SsoSharedWith,
-				BackchannelLogoutURI: c.BackchannelLogoutUri,
+				ID:                     c.Id,
+				Name:                   c.Name,
+				RedirectURIs:           c.RedirectUris,
+				TrustedPeers:           c.TrustedPeers,
+				Public:                 c.Public,
+				LogoURL:                c.LogoUrl,
+				AllowedConnectors:      c.AllowedConnectors,
+				SSOSharedWith:          c.SsoSharedWith,
+				BackchannelLogoutURI:   c.BackchannelLogoutUri,
+				PostLogoutRedirectURIs: c.PostLogoutRedirectUris,
 			}
 		} else if err != nil {
 			fail(err)
@@ -316,16 +318,17 @@ func (s *Server) handleAdminCreateClient(w http.ResponseWriter, r *http.Request)
 
 	req := &api.CreateClientReq{
 		Client: &api.Client{
-			Id:                   r.FormValue("id"),
-			Name:                 r.FormValue("name"),
-			Secret:               r.FormValue("secret"),
-			LogoUrl:              r.FormValue("logo_url"),
-			RedirectUris:         r.Form["redirect_uris"],
-			TrustedPeers:         r.Form["trusted_peers"],
-			AllowedConnectors:    r.Form["allowed_connectors"],
-			SsoSharedWith:        r.Form["sso_shared_with"],
-			BackchannelLogoutUri: r.FormValue("backchannel_logout_uri"),
-			Public:               r.FormValue("public") != "",
+			Id:                     r.FormValue("id"),
+			Name:                   r.FormValue("name"),
+			Secret:                 r.FormValue("secret"),
+			LogoUrl:                r.FormValue("logo_url"),
+			RedirectUris:           r.Form["redirect_uris"],
+			TrustedPeers:           r.Form["trusted_peers"],
+			AllowedConnectors:      r.Form["allowed_connectors"],
+			SsoSharedWith:          r.Form["sso_shared_with"],
+			BackchannelLogoutUri:   r.FormValue("backchannel_logout_uri"),
+			PostLogoutRedirectUris: r.Form["post_logout_redirect_uris"],
+			Public:                 r.FormValue("public") != "",
 		},
 	}
 
@@ -502,14 +505,15 @@ func (s *Server) handleAdminUpdateClient(w http.ResponseWriter, r *http.Request)
 	backchannelLogoutURI := r.FormValue("backchannel_logout_uri")
 
 	resp, err := s.admin.api.UpdateClient(ctx, &api.UpdateClientReq{
-		Id:                   id,
-		Name:                 r.FormValue("name"),
-		LogoUrl:              r.FormValue("logo_url"),
-		RedirectUris:         r.Form["redirect_uris"],
-		TrustedPeers:         r.Form["trusted_peers"],
-		AllowedConnectors:    r.Form["allowed_connectors"],
-		SsoSharedWith:        r.Form["sso_shared_with"],
-		BackchannelLogoutUri: &backchannelLogoutURI,
+		Id:                     id,
+		Name:                   r.FormValue("name"),
+		LogoUrl:                r.FormValue("logo_url"),
+		RedirectUris:           r.Form["redirect_uris"],
+		TrustedPeers:           r.Form["trusted_peers"],
+		AllowedConnectors:      r.Form["allowed_connectors"],
+		SsoSharedWith:          r.Form["sso_shared_with"],
+		BackchannelLogoutUri:   &backchannelLogoutURI,
+		PostLogoutRedirectUris: r.Form["post_logout_redirect_uris"],
 	})
 	switch {
 	case err != nil:

examples/example-app/server/admin.go

@@ -39,16 +39,17 @@ func (s *Server) handleAdminClientDetail(w http.ResponseWriter, r *http.Request)
 	default:
 		c := resp.Client
 		data.Client = &AdminClient{
-			ID:                   c.Id,
-			Name:                 c.Name,
-			Secret:               c.Secret,
-			RedirectURIs:         c.RedirectUris,
-			TrustedPeers:         c.TrustedPeers,
-			Public:               c.Public,
-			LogoURL:              c.LogoUrl,
-			AllowedConnectors:    c.AllowedConnectors,
-			SSOSharedWith:        c.SsoSharedWith,
-			BackchannelLogoutURI: c.BackchannelLogoutUri,
+			ID:                     c.Id,
+			Name:                   c.Name,
+			Secret:                 c.Secret,
+			RedirectURIs:           c.RedirectUris,
+			TrustedPeers:           c.TrustedPeers,
+			Public:                 c.Public,
+			LogoURL:                c.LogoUrl,
+			AllowedConnectors:      c.AllowedConnectors,
+			SSOSharedWith:          c.SsoSharedWith,
+			BackchannelLogoutURI:   c.BackchannelLogoutUri,
+			PostLogoutRedirectURIs: c.PostLogoutRedirectUris,
 		}
 	}
 

examples/example-app/server/admindetail.go

@@ -223,16 +223,17 @@ type AdminRefreshToken struct {
 // AdminClient is one OAuth2 client as the API reports it — every field it has,
 // since a list that shows three of nine invites you to guess the rest.
 type AdminClient struct {
-	ID                   string
-	Name                 string
-	Secret               string
-	RedirectURIs         []string
-	TrustedPeers         []string
-	Public               bool
-	LogoURL              string
-	AllowedConnectors    []string
-	SSOSharedWith        []string
-	BackchannelLogoutURI string
+	ID                     string
+	Name                   string
+	Secret                 string
+	RedirectURIs           []string
+	TrustedPeers           []string
+	Public                 bool
+	LogoURL                string
+	AllowedConnectors      []string
+	SSOSharedWith          []string
+	BackchannelLogoutURI   string
+	PostLogoutRedirectURIs []string
 }
 
 // AdminPassword is one local password entry as the API reports it.

examples/example-app/server/render.go

@@ -147,6 +147,18 @@
                 <small class="hint">Which clients may reuse this one's session. * for all.</small>
             </div>
         </div>
+        <div class="form-row form-row--wide">
+            <label for="post_logout_redirect_uris_input">Post-logout redirect URIs</label>
+            <div class="form-control">
+                <div class="chips" data-name="post_logout_redirect_uris">
+                </div>
+                <div class="inline-input">
+                    <input type="text" id="post_logout_redirect_uris_input" class="chip-input" autocomplete="off">
+                    <button type="button" class="button button-small chip-add">Add</button>
+                </div>
+                <small class="hint">Where the browser may be sent after logging out. Anything not listed is refused.</small>
+            </div>
+        </div>
         <div class="form-row form-row--wide">
             <label for="c_backchannel_logout_uri">Back-channel logout URI</label>
             <div class="form-control">
@@ -235,6 +247,19 @@
                 <small class="hint">Which clients may reuse this one's session. * for all.</small>
             </div>
         </div>
+        <div class="form-row form-row--wide">
+            <label for="post_logout_redirect_uris_input">Post-logout redirect URIs</label>
+            <div class="form-control">
+                <div class="chips" data-name="post_logout_redirect_uris">
+                {{range .PostLogoutRedirectURIs}}<span class="chip"><span>{{.}}</span><input type="hidden" name="post_logout_redirect_uris" value="{{.}}"><button type="button" class="chip-remove">&times;</button></span>{{end}}
+                </div>
+                <div class="inline-input">
+                    <input type="text" id="post_logout_redirect_uris_input" class="chip-input" autocomplete="off">
+                    <button type="button" class="button button-small chip-add">Add</button>
+                </div>
+                <small class="hint">Where the browser may be sent after logging out. Anything not listed is refused.</small>
+            </div>
+        </div>
         <div class="form-row form-row--wide">
             <label for="e_backchannel_logout_uri">Back-channel logout URI</label>
             <div class="form-control">

examples/example-app/server/templates/admin.html

@@ -27,6 +27,8 @@
         <div class="v mono">{{range .AllowedConnectors}}{{.}}<br>{{else}}<span class="hint">all</span>{{end}}</div>
         <div class="k">SSO shared with</div>
         <div class="v mono">{{range .SSOSharedWith}}{{.}}<br>{{else}}<span class="hint">the sessions default</span>{{end}}</div>
+        <div class="k">Post-logout redirect URIs</div>
+        <div class="v mono">{{range .PostLogoutRedirectURIs}}{{.}}<br>{{else}}<span class="hint">none — logout cannot redirect back</span>{{end}}</div>
         <div class="k">Back-channel logout URI</div>
         <div class="v mono">{{if .BackchannelLogoutURI}}{{.BackchannelLogoutURI}}{{else}}<span class="hint">not set — this client is not notified when a session ends</span>{{end}}</div>
     </div>

examples/example-app/server/templates/detail.html

@@ -17,16 +17,17 @@ func (d dexAPI) GetClient(ctx context.Context, req *api.GetClientReq) (*api.GetC
 
 	return &api.GetClientResp{
 		Client: &api.Client{
-			Id:                   c.ID,
-			Name:                 c.Name,
-			Secret:               c.Secret,
-			RedirectUris:         c.RedirectURIs,
-			TrustedPeers:         c.TrustedPeers,
-			Public:               c.Public,
-			LogoUrl:              c.LogoURL,
-			AllowedConnectors:    c.AllowedConnectors,
-			SsoSharedWith:        c.SSOSharedWith,
-			BackchannelLogoutUri: c.BackchannelLogoutURI,
+			Id:                     c.ID,
+			Name:                   c.Name,
+			Secret:                 c.Secret,
+			RedirectUris:           c.RedirectURIs,
+			TrustedPeers:           c.TrustedPeers,
+			Public:                 c.Public,
+			LogoUrl:                c.LogoURL,
+			AllowedConnectors:      c.AllowedConnectors,
+			SsoSharedWith:          c.SSOSharedWith,
+			BackchannelLogoutUri:   c.BackchannelLogoutURI,
+			PostLogoutRedirectUris: c.PostLogoutRedirectURIs,
 		},
 	}, nil
 }
@@ -44,16 +45,17 @@ func (d dexAPI) CreateClient(ctx context.Context, req *api.CreateClientReq) (*ap
 	}
 
 	c := storage.Client{
-		ID:                   req.Client.Id,
-		Secret:               req.Client.Secret,
-		RedirectURIs:         req.Client.RedirectUris,
-		TrustedPeers:         req.Client.TrustedPeers,
-		Public:               req.Client.Public,
-		Name:                 req.Client.Name,
-		LogoURL:              req.Client.LogoUrl,
-		AllowedConnectors:    req.Client.AllowedConnectors,
-		SSOSharedWith:        req.Client.SsoSharedWith,
-		BackchannelLogoutURI: req.Client.BackchannelLogoutUri,
+		ID:                     req.Client.Id,
+		Secret:                 req.Client.Secret,
+		RedirectURIs:           req.Client.RedirectUris,
+		TrustedPeers:           req.Client.TrustedPeers,
+		Public:                 req.Client.Public,
+		Name:                   req.Client.Name,
+		LogoURL:                req.Client.LogoUrl,
+		AllowedConnectors:      req.Client.AllowedConnectors,
+		SSOSharedWith:          req.Client.SsoSharedWith,
+		BackchannelLogoutURI:   req.Client.BackchannelLogoutUri,
+		PostLogoutRedirectURIs: req.Client.PostLogoutRedirectUris,
 	}
 	if err := d.s.CreateClient(ctx, c); err != nil {
 		if err == storage.ErrAlreadyExists {
@@ -97,6 +99,9 @@ func (d dexAPI) UpdateClient(ctx context.Context, req *api.UpdateClientReq) (*ap
 		if req.BackchannelLogoutUri != nil {
 			old.BackchannelLogoutURI = req.GetBackchannelLogoutUri()
 		}
+		if req.PostLogoutRedirectUris != nil {
+			old.PostLogoutRedirectURIs = req.PostLogoutRedirectUris
+		}
 		return old, nil
 	})
 	if err != nil {
@@ -131,15 +136,16 @@ func (d dexAPI) ListClients(ctx context.Context, req *api.ListClientReq) (*api.L
 	clients := make([]*api.ClientInfo, 0, len(clientList))
 	for _, client := range clientList {
 		c := api.ClientInfo{
-			Id:                   client.ID,
-			Name:                 client.Name,
-			RedirectUris:         client.RedirectURIs,
-			TrustedPeers:         client.TrustedPeers,
-			Public:               client.Public,
-			LogoUrl:              client.LogoURL,
-			AllowedConnectors:    client.AllowedConnectors,
-			SsoSharedWith:        client.SSOSharedWith,
-			BackchannelLogoutUri: client.BackchannelLogoutURI,
+			Id:                     client.ID,
+			Name:                   client.Name,
+			RedirectUris:           client.RedirectURIs,
+			TrustedPeers:           client.TrustedPeers,
+			Public:                 client.Public,
+			LogoUrl:                client.LogoURL,
+			AllowedConnectors:      client.AllowedConnectors,
+			SsoSharedWith:          client.SSOSharedWith,
+			BackchannelLogoutUri:   client.BackchannelLogoutURI,
+			PostLogoutRedirectUris: client.PostLogoutRedirectURIs,
 		}
 		clients = append(clients, &c)
 	}