OIDC Logout

[adur1990]

Is your feature request related to a problem? Please describe.
I am using keycloak for SSO and also SLO. While SSO is working including access restrictions and everything I need, logout is not working. I would like to have the option that if one client is logged out (e.g. the user logs out in grafana), users in filebrowser should also be logged out. It works the other way around using the logout option in keycloak clients. But filebrowser has no option to achieve this as the JWT is required using /api/auth/logout.

Describe the solution you'd like
Best would be some sort of either backchannel logout, but frontchannel would also be ok if easier.

[gtsteffaniak]

That is how it works to some degree -- but there may be a delay. filebrowser doesn't use the jwt claim from your OIDC, it instead validates the jwt from OIDC and creates a filebrowser quantum specific jwt token. This token is valid until expired, based on tokenExpirationHours

So, a logout from the OIDC would eventually logout the user once the quantum jwt expires and it tries to renew with OIDC.

A back-channel logout would need to be configured on your OIDC. Filebrowser Quantum has a logout api your OIDC could be configured to call if needed -- let me check if its compatible with this scenario.