Quarkus oidc integration, backchannel logout support

[tassadar81]

Description

As discussed with @sberyozkin on Zulip a backchannel logout feature is missing in the oidc quarkus integration. In some scenarios like two clients in the same realm such functionality is necessary. The route for backchannel consumes a jwt token and i guess it has to be public and able to reconize the user session from this token.
An old issue was opend btw, i report it here for reference #4481

Thank you

Implementation ideas

No response

[quarkus-bot]

/cc @pedroigor, @sberyozkin

[orivat]

@sberyozkin

I have made a test with:
-Keycloak
-quarkus OIDC client app (1)
-Jboss OIDC client app (2)

step 1
Jboss and quarkus are authenticated against Keycloak

step 2:
The user session is terminated at Keycloak

step3:
-Jboss app is disconnected
-Quarkus app remains active.

With Jboss app, keycloak is using JBoss client adapater.
When you click the Logout all button (of keycloak), all SSO cookies become invalid, and clients requesting authentication within active browser sessions must log in again. Keycloak notifies clients by using the Keycloak OIDC client adapter of the logout event

I agree that Quarkus client apps do not receive logout back channel notification, as mentioned in thread #23477

Therefore to prepare migration from wildly /jboss app to quarkus, being able to support RP backchannel notifications is something really important for a seamless integratin for OIDC client.

[sberyozkin]

@orivat This is the issue I'd try to prioritize upon.

@tassadar81 @pedroigor How does Keycloak do the backchannel logout ? The way it is described at https://openid.net/specs/openid-connect-backchannel-1_0.html or differently ? I have not been able to confirm it in the docs.

Thanks

[sberyozkin]

@tassadar81 @pedroigor If it is a logout JWT token then we can verify it and then compare its iss/aud claim values with the ones from the current ID token and remove the session token in case of the match

[sberyozkin]

@orivat we have a draft PR at #24611 and will do a few more checks; in meantime, if you could try that PR in your setup and let us know if it works as expected then it would help, thanks