Feature summary:
Add
- performBackChannelLogout( $requestData ) to PluggableAuthPlugin
- REST endpoint that can be registered with an external authentication provider, which calls this function
- Using it should be made configurable
There are some open questions though:
- How to deal with Multiple-Plugin-Setups? Do we need an ID as part of the REST endpoint?
- What exactly to pass to that function? Just raw request data? Is pre-processing/validation required?
Use case(s)
- If a user logs out from a central authentication system, all sessions in connected applications should also be terminated
Benefits:
It improves security, as it prevents that a user needs to end sessions on multiple applications
At least two extensions may use this:
- Extension:OpenIDConnect
- Extension:SimpleSAMLphp (probably)