GUACAMOLE-519: Implement Single Logout on OpenID Extension

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/AuthenticationProviderService.java

@@ -130,9 +130,33 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
                 .build();
     }
 
+    @Override
+    public URI getLogoutURI(String idToken) throws GuacamoleException {
+
+        // If no logout endpoint is configured, return null
+        URI logoutEndpoint = confService.getLogoutEndpoint();
+        if (logoutEndpoint == null)
+            return null;
+
+        // Build the logout URI with appropriate parameters
+        UriBuilder logoutUriBuilder = UriBuilder.fromUri(logoutEndpoint);
+
+        // Add post_logout_redirect_uri parameter
+        logoutUriBuilder.queryParam("post_logout_redirect_uri",
+                confService.getPostLogoutRedirectURI());
+
+        // Add id_token_hint if available, otherwise add client_id
+        if (idToken != null && !idToken.isEmpty())
+            logoutUriBuilder.queryParam("id_token_hint", idToken);
+        else
+            logoutUriBuilder.queryParam("client_id", confService.getClientID());
+
+        return logoutUriBuilder.build();
+    }
+
     @Override
     public void shutdown() {
         // Nothing to clean up
     }
-    
+
 }

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/conf/ConfigurationService.java

@@ -217,7 +217,32 @@ public class ConfigurationService {
 
         @Override
         public String getName() { return "openid-redirect-uri"; }
-        
+
+    };
+
+    /**
+     * The logout endpoint (URI) of the OpenID service. If specified, users
+     * will be redirected to this endpoint when they log out, allowing them
+     * to log out from the OpenID provider as well.
+     */
+    private static final URIGuacamoleProperty OPENID_LOGOUT_ENDPOINT =
+            new URIGuacamoleProperty() {
+
+        @Override
+        public String getName() { return "openid-logout-endpoint"; }
+
+    };
+
+    /**
+     * The URI that the OpenID service should redirect to after logout is
+     * complete. If not specified, the main redirect URI will be used.
+     */
+    private static final URIGuacamoleProperty OPENID_POST_LOGOUT_REDIRECT_URI =
+            new URIGuacamoleProperty() {
+
+        @Override
+        public String getName() { return "openid-post-logout-redirect-uri"; }
+
     };
 
     /**
@@ -429,4 +454,39 @@ public class ConfigurationService {
         return environment.getProperty(OPENID_MAX_NONCE_VALIDITY, DEFAULT_MAX_NONCE_VALIDITY);
     }
 
+    /**
+     * Returns the logout endpoint (URI) of the OpenID service, as configured
+     * with guacamole.properties. If configured, users will be redirected to
+     * this endpoint when they log out from Guacamole.
+     *
+     * @return
+     *     The logout endpoint of the OpenID service, as configured with
+     *     guacamole.properties, or null if not configured.
+     *
+     * @throws GuacamoleException
+     *     If guacamole.properties cannot be parsed.
+     */
+    public URI getLogoutEndpoint() throws GuacamoleException {
+        return environment.getProperty(OPENID_LOGOUT_ENDPOINT);
+    }
+
+    /**
+     * Returns the URI that the OpenID service should redirect to after logout
+     * is complete, as configured with guacamole.properties. If not configured,
+     * the main redirect URI will be used.
+     *
+     * @return
+     *     The post-logout redirect URI, as configured with
+     *     guacamole.properties, or the main redirect URI if not specified.
+     *
+     * @throws GuacamoleException
+     *     If guacamole.properties cannot be parsed.
+     */
+    public URI getPostLogoutRedirectURI() throws GuacamoleException {
+        URI postLogoutRedirectURI = environment.getProperty(OPENID_POST_LOGOUT_REDIRECT_URI);
+        if (postLogoutRedirectURI != null)
+            return postLogoutRedirectURI;
+        return getRedirectURI();
+    }
+
 }