GUACAMOLE-519: Implement Single Logout on OpenID Extension

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/SSOAuthenticationProviderService.java

@@ -63,6 +63,28 @@ public interface SSOAuthenticationProviderService {
      */
     URI getLoginURI() throws GuacamoleException;
 
+    /**
+     * Returns the full URI of the logout endpoint to which a user should be
+     * redirected when they log out from Guacamole. This allows the user to
+     * also log out from the SSO identity provider. If no logout endpoint is
+     * configured, null is returned.
+     *
+     * @param idToken
+     *     The ID token or authentication token from the user's session, if
+     *     available. This may be used as an id_token_hint parameter in the
+     *     logout request. May be null if not available.
+     *
+     * @return
+     *     The full URI of the SSO logout endpoint, or null if not configured.
+     *
+     * @throws GuacamoleException
+     *     If configuration information required for generating the logout URI
+     *     cannot be read.
+     */
+    default URI getLogoutURI(String idToken) throws GuacamoleException {
+        return null;
+    }
+
     /**
      * Frees all resources associated with the relevant
      * SSOAuthenticationProvider implementation. This function is automatically
@@ -70,5 +92,5 @@ public interface SSOAuthenticationProviderService {
      * down.
      */
     void shutdown();
-    
+
 }

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/SSOResource.java

@@ -19,9 +19,11 @@
 package org.apache.guacamole.auth.sso;
 
 import com.google.inject.Inject;
+import java.net.URI;
 import javax.ws.rs.core.Response;
 import javax.ws.rs.GET;
 import javax.ws.rs.Path;
+import javax.ws.rs.QueryParam;
 import org.apache.guacamole.GuacamoleException;
 
 /**
@@ -55,4 +57,33 @@ public class SSOResource {
         return Response.seeOther(authService.getLoginURI()).build();
     }
 
+    /**
+     * Redirects the user to the identity provider's logout endpoint, if
+     * configured. This allows the user to log out from both Guacamole and the
+     * SSO identity provider. If no logout endpoint is configured, a 204 No
+     * Content response is returned.
+     *
+     * @param idToken
+     *     The ID token from the user's authentication session, if available.
+     *     This will be included as the id_token_hint parameter in the logout
+     *     request. May be null.
+     *
+     * @return
+     *     An HTTP Response that will redirect the user to the IdP logout
+     *     endpoint if configured, or a 204 No Content response otherwise.
+     *
+     * @throws GuacamoleException
+     *     If an error occurs preventing the redirect from being created.
+     */
+    @GET
+    @Path("logout")
+    public Response getLogoutRedirect(
+            @QueryParam("id_token") String idToken) throws GuacamoleException {
+        URI logoutURI = authService.getLogoutURI(idToken);
+        if (logoutURI != null)
+            return Response.seeOther(logoutURI).build();
+        else
+            return Response.noContent().build();
+    }
+
 }