在 Spring 授权服务器中是否有 OIDC Session 管理和注销机制的实现，用于实现 Single Sing On？

Question

I am trying to implement Single Sing On using Spring Authorization Server which is based on oAuth2 and OIDC for Authorization and Authentication respectively, but as per the Spring Authorization Server feature list OIDC support is not fully integrated. Mainly the session management and logout part, I couldn't find. Also if there's any workaround for implementing sso and logout?

Feature List URL: https://docs.spring.io/spring-authorization-server/docs/current/reference/html/overview.html

Answer 1

These features are still on the backlog but are not scheduled yet (as of the time of this writing). See #58 and #266 respectively to follow progress on these features.

Given that there are a number of pieces to the specifications for both of these features, I imagine it would be a bit of a hassle to attempt a fully spec-compliant implementation of them as extensions to SAS (though I'm sure it's possible). Instead, you might pick a minimal subset of the logout feature as a way to get started.

Using Spring Security configuration, you can configure a logout endpoint in a custom way. Here's some pseudocode to get you started:

@Bean
public SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests((authorize) -> authorize
            .anyRequest().authenticated()
        )
        .formLogin(Customizer.withDefaults())
        .logout((logout) -> logout
            .logoutRequestMatcher(new OrRequestMatcher(
                new AntPathRequestMatcher("/logout", "GET"),
                new AntPathRequestMatcher("/logout", "POST")
            ))
            .addLogoutHandler((request, response, authentication) -> {
                // Logic to validate an id_token_hint, client_id, etc.
                // Throw exception in case of invalid request
            })
            .logoutSuccessHandler((request, response, authentication) -> {
                // Get state and calculate redirect for logout success back to client
                // http://127.0.0.1:8080/logout?success&state=...
                // new SimpleUrlLogoutSuccessHandler()...
            })
        );
    return http.build();
}

This assumes validation of some kind is implemented to prevent CSRF, denial of service, etc. You might also choose to add a logout confirmation page as a separate endpoint of the auth server that redirects to the logout endpoint when the user clicks a "Confirm" button, etc.

To use this, you simply redirect from your client application to the logout confirmation page, which redirects to the logout endpoint on confirm, which then redirects back to the client (which can then log out of the client automatically).