diff --git a/gregsite/settings/base.py b/gregsite/settings/base.py index e8490003e7f2904161a5666f298212ffa4738539..e1b4a4064188945312e4d1996d6cd2ca261ae5ee 100644 --- a/gregsite/settings/base.py +++ b/gregsite/settings/base.py @@ -165,6 +165,7 @@ OIDC_OP_AUTHORIZATION_ENDPOINT = "https://auth.dataporten.no/oauth/authorization OIDC_OP_TOKEN_ENDPOINT = "https://auth.dataporten.no/oauth/token" OIDC_OP_USER_ENDPOINT = "https://auth.dataporten.no/openid/userinfo" OIDC_OP_FEIDE_EXTENDED_USER_ENDPOINT = "https://api.dataporten.no/userinfo/v1/userinfo" +OIDC_STORE_ID_TOKEN = True ALLOW_LOGOUT_GET_METHOD = True OIDC_END_SESSION_ENDPOINT = "https://auth.dataporten.no/openid/endsession" diff --git a/gregui/authentication/auth_backends.py b/gregui/authentication/auth_backends.py index c8d5b3222146a35d423fce18c7024cd4a165a6a7..ac0942ccee7e8e57042c9f9d5faae7c090ae1fbb 100644 --- a/gregui/authentication/auth_backends.py +++ b/gregui/authentication/auth_backends.py @@ -1,6 +1,7 @@ import datetime import re import time +import urllib.parse from typing import Optional import requests @@ -689,5 +690,12 @@ class GregOIDCBackend(ValidatingOIDCBackend): def provider_logout(request): - redirect_url = settings.OIDC_END_SESSION_ENDPOINT - return redirect_url + id_token = request.session.get("oidc_id_token") + query_params = urllib.parse.urlencode( + { + "id_token_hint": id_token, + "post_logout_redirect_uri": settings.LOGOUT_REDIRECT_URL, + } + ) + logout_request_url = f"{settings.OIDC_END_SESSION_ENDPOINT}?{query_params}" + return logout_request_url