feat(oidc): move back-channel logout from beta to GA (#11493)

# Which Problems Are Solved

This PR marks the OIDC Back-Channel Logout as general available (GA).

# How the Problems Are Solved

- API:
- deprecated the feature toggle (to prevent breaking changes) in v2beta
and v2 API
  - removed all related event logic and updated the projection iteration
  - removed the toggle usage for back-channel logout
  - removed related translations
- Management Console:
  - removed the feature toggle and its translations
- Docs:
  - removed all beta labels and feature toggle notes

# Additional Changes

none

# Additional Context

- closes #11277 
- requires backport to v4.x

apps/docs/content/guides/integrate/back-channel-logout.mdx

@@ -7,12 +7,6 @@ The Back-Channel Logout implements [OpenID Connect Back-Channel Logout 1.0](http
 and can be used to notify applications about session termination at the OpenID Provider. This guide will explain how
 back-channel logout is implemented inside ZITADEL and gives some usage examples.
 
-<Callout type="info">
-Back-Channel Logout is currently an experimental [beta](https://help.zitadel.com/zitadel-software-release-cycle#beta) feature.
-Be sure to enable it on the [feature API](#feature-api) before using it.
-We highly recommend also enabling the `webkey` feature on your instance. This will prevent issues with automatic key rotation.
-</Callout>
-
 In this guide we assume your already familiar with getting and validation token. You should already have a good
 understanding on the following topics before starting with this guide:
 
@@ -51,7 +45,7 @@ The application can then invalidate the user's session without the need for an a
 
 As required by the [specification](https://openid.net/specs/openid-connect-backchannel-1_0.html#BCSupport), ZITADEL
 will advertise the `backchannel_logout_supported` and `backchannel_logout_session_supported`
-on the discovery endpoint once the feature flag is enabled.
+on the discovery endpoint by default.
 The latter boolean indicates, that ZITADEL will provide a session ID (`sid`) claim as part of the logout token. This
 provides the possibility to match the exact SSO session, which was terminated.
 
@@ -85,7 +79,7 @@ The following Claims are used within the Logout Token:
 
 | Claim  | Example                                                        | Description                                                                                                                          |
 |--------|----------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|
-| iss    | `${CUSTOM_DOMAIN}`                                            | Issuer Identifier                                                                                                                    |
+| iss    | `${CUSTOM_DOMAIN}`                                             | Issuer Identifier                                                                                                                    |
 | sub    | `77776025198584418`                                            | Subject Identifier (the user who signed out)                                                                                         |
 | aud    | `69234237810729019`                                            | Audience(s), will always contain your client_id                                                                                      |
 | iat    | `1311280970`                                                   | Issued at time                                                                                                                       |

cmd/defaults.yaml

@@ -1291,7 +1291,6 @@ DefaultInstance:
     #   - 5 # OrgDomainVerified
     DebugOIDCParentError: # ZITADEL_DEFAULTINSTANCE_FEATURES_DEBUGOIDCPARENTERROR
     OIDCSingleV1SessionTermination: # ZITADEL_DEFAULTINSTANCE_FEATURES_OIDCSINGLEV1SESSIONTERMINATION
-    EnableBackChannelLogout: # ZITADEL_DEFAULTINSTANCE_FEATURES_ENABLEBACKCHANNELLOGOUT
     LoginV2:
       Required: true # ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED
       BaseURI: # ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_BASEURI

console/src/app/components/features/features.component.ts

@@ -29,7 +29,6 @@ import { LoginV2FeatureToggleComponent } from '../feature-toggle/login-v2-featur
 const FEATURE_KEYS = [
   'consoleUseV2UserApi',
   'debugOidcParentError',
-  'enableBackChannelLogout',
   // 'improvedPerformance',
   'loginDefaultOrg',
   'oidcSingleV1SessionTermination',

console/src/assets/i18n/ar.json

@@ -1638,8 +1638,6 @@
       "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "إذا تم تمكين العلامة، فستتمكن من إنهاء جلسة واحدة من واجهة تسجيل الدخول من خلال توفير id_token مع مطالبة `sid` كـ id_token_hint في نقطة نهاية end_session. لاحظ أنه حالياً يتم إنهاء جميع الجلسات من نفس وكيل المستخدم (المتصفح) في واجهة تسجيل الدخول. الجلسات التي تدار من خلال Session API تسمح بالفعل بإنهاء جلسات فردية.",
       "DEBUGOIDCPARENTERROR": "تصحيح خطأ OIDC Parent",
       "DEBUGOIDCPARENTERROR_DESCRIPTION": "إذا تم تمكين العلامة، سيتم تسجيل خطأ OIDC parent في وحدة التحكم.",
-      "ENABLEBACKCHANNELLOGOUT": "تمكين تسجيل الخروج عبر القناة الخلفية (Backchannel Logout)",
-      "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "ينفذ تسجيل الخروج عبر القناة الخلفية OpenID Connect Back-Channel Logout 1.0 ويمكن استخدامه لإخطار التطبيقات بإنهاء الجلسة في مزود OpenID.",
       "PERMISSIONCHECKV2": "فحص الأذونات V2",
       "PERMISSIONCHECKV2_DESCRIPTION": "إذا تم تمكين العلامة، فستتمكن من استخدام API الجديد وميزاته.",
       "STATES": {

console/src/assets/i18n/bg.json

@@ -1645,8 +1645,6 @@
       "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "Ако флагът е активиран, ще можете да прекратите единична сесия от UI за вход, като предоставите id_token с `sid` претенция като id_token_hint на крайната точка на end_session. Имайте предвид, че в момента всички сесии от същия потребителски агент (браузър) се прекратяват в UI за вход. Сесиите, управлявани чрез API на сесията, вече позволяват прекратяването на единични сесии.",
       "DEBUGOIDCPARENTERROR": "Отстраняване на грешки на OIDC родителя",
       "DEBUGOIDCPARENTERROR_DESCRIPTION": "Ако флагът е активиран, грешката на OIDC родителя ще бъде записана в конзолата.",
-      "ENABLEBACKCHANNELLOGOUT": "Активиране на Backchannel Logout",
-      "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "Back-Channel Logout имплементира OpenID Connect Back-Channel Logout 1.0 и може да се използва за уведомяване на приложенията за прекратяване на сесията при OpenID доставчика.",
       "PERMISSIONCHECKV2": "Проверка на разрешения V2",
       "PERMISSIONCHECKV2_DESCRIPTION": "Ако флагът е активиран, ще можете да използвате новия API и неговите функции.",
       "STATES": {

console/src/assets/i18n/cs.json

@@ -1643,8 +1643,6 @@
       "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "Pokud je příznak aktivován, budete moci ukončit jedinou relaci z rozhraní pro přihlášení zadáním id_token s nárokem `sid` jako id_token_hint na koncovém bodu end_session. Poznamenejte si, že v současné době jsou v rozhraní pro přihlášení ukončeny všechny relace ze stejného uživatelského agenta (prohlížeče). Relace spravované prostřednictvím rozhraní API relace již umožňují ukončení jednotlivých relací.",
       "DEBUGOIDCPARENTERROR": "Debugování chyby rodiče OIDC",
       "DEBUGOIDCPARENTERROR_DESCRIPTION": "Pokud je příznak povolen, chyba rodiče OIDC bude zaznamenána v konzoli.",
-      "ENABLEBACKCHANNELLOGOUT": "Povolit Backchannel Logout",
-      "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "Back-Channel Logout implementuje OpenID Connect Back-Channel Logout 1.0 a může být použit k informování aplikací o ukončení relace u poskytovatele OpenID.",
       "PERMISSIONCHECKV2": "Kontrola oprávnění V2",
       "PERMISSIONCHECKV2_DESCRIPTION": "Pokud je příznak povolen, budete moci používat nový API a jeho funkce.",
       "STATES": {

console/src/assets/i18n/de.json

@@ -1643,8 +1643,6 @@
       "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "Wenn das Flag aktiviert ist, können Sie eine einzelne Sitzung über die Login-Benutzeroberfläche beenden, indem Sie einen id_token mit einem `sid` Claim als id_token_hint am Endpunkt end_session übergeben. Beachten Sie, dass derzeit alle Sitzungen desselben Benutzeragenten (Browser) in der Login-Benutzeroberfläche beendet werden. Sitzungen, die über die Session API verwaltet werden, ermöglichen bereits die Beendigung einzelner Sitzungen.",
       "DEBUGOIDCPARENTERROR": "Debug OIDC Parent error",
       "DEBUGOIDCPARENTERROR_DESCRIPTION": "Wenn die Flagge aktiviert ist, wird der OIDC-Elternfehler in der Konsole protokolliert.",
-      "ENABLEBACKCHANNELLOGOUT": "Backchannel-Logout aktivieren",
-      "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "Der Back-Channel-Logout implementiert OpenID Connect Back-Channel Logout 1.0 und kann verwendet werden, um Anwendungen über die Beendigung der Sitzung beim OpenID-Provider zu benachrichtigen.",
       "PERMISSIONCHECKV2": "Berechtigungsprüfung V2",
       "PERMISSIONCHECKV2_DESCRIPTION": "Wenn die Flagge aktiviert ist, können Sie die neue API und ihre Funktionen verwenden.",
       "STATES": {

console/src/assets/i18n/en.json

@@ -1647,8 +1647,6 @@
       "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "If the flag is enabled, you'll be able to terminate a single session from the login UI by providing an id_token with a `sid` claim as id_token_hint on the end_session endpoint. Note that currently all sessions from the same user agent (browser) are terminated in the login UI. Sessions managed through the Session API already allow the termination of single sessions.",
       "DEBUGOIDCPARENTERROR": "Debug OIDC Parent Error",
       "DEBUGOIDCPARENTERROR_DESCRIPTION": "If the flag is enabled, the OIDC parent error will be logged in the console.",
-      "ENABLEBACKCHANNELLOGOUT": "Enable Backchannel Logout",
-      "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "The Back-Channel Logout implements OpenID Connect Back-Channel Logout 1.0 and can be used to notify applications about session termination at the OpenID Provider.",
       "PERMISSIONCHECKV2": "Permission Check V2",
       "PERMISSIONCHECKV2_DESCRIPTION": "If the flag is enabled, you'll be able to use the new API and its features.",
       "STATES": {

console/src/assets/i18n/es.json

@@ -1644,8 +1644,6 @@
       "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "Si la bandera está habilitada, podrá terminar una sesión única desde la interfaz de usuario de inicio de sesión proporcionando un id_token con una reclamación `sid` como id_token_hint en el punto final de end_session. Tenga en cuenta que actualmente se terminan todas las sesiones del mismo agente de usuario (navegador) en la interfaz de usuario de inicio de sesión. Las sesiones administradas a través de la API de sesión ya permiten la terminación de sesiones individuales.",
       "DEBUGOIDCPARENTERROR": "Debug OIDC Parent Error",
       "DEBUGOIDCPARENTERROR_DESCRIPTION": "Si la bandera está habilitada, el error del padre OIDC se registrará en la consola.",
-      "ENABLEBACKCHANNELLOGOUT": "Habilitar Backchannel Logout",
-      "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "El Back-Channel Logout implementa OpenID Connect Back-Channel Logout 1.0 y se puede usar para notificar a las aplicaciones sobre la terminación de la sesión en el proveedor de OpenID.",
       "PERMISSIONCHECKV2": "Verificación de permisos V2",
       "PERMISSIONCHECKV2_DESCRIPTION": "Si la bandera está habilitada, podrá usar la nueva API y sus funciones.",
       "STATES": {

console/src/assets/i18n/fr.json

@@ -1643,8 +1643,6 @@
       "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "Si l'indicateur est activé, vous pourrez terminer une seule session à partir de l'interface utilisateur de connexion en fournissant un id_token avec une revendication `sid` en tant que id_token_hint sur le point de terminaison end_session. Notez que toutes les sessions du même agent utilisateur (navigateur) sont actuellement terminées dans l'interface utilisateur de connexion. Les sessions gérées via l'API de session permettent déjà la terminaison de sessions individuelles.",
       "DEBUGOIDCPARENTERROR": "Debug OIDC Parent Error",
       "DEBUGOIDCPARENTERROR_DESCRIPTION": "Si le drapeau est activé, l'erreur parent OIDC sera enregistrée dans la console.",
-      "ENABLEBACKCHANNELLOGOUT": "Activer le Backchannel Logout",
-      "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "Le Back-Channel Logout implémente OpenID Connect Back-Channel Logout 1.0 et peut être utilisé pour notifier les applications de la fin de session chez le fournisseur OpenID.",
       "PERMISSIONCHECKV2": "Vérification des permissions V2",
       "PERMISSIONCHECKV2_DESCRIPTION": "Si le drapeau est activé, vous pourrez utiliser la nouvelle API et ses fonctionnalités.",
       "STATES": {

console/src/assets/i18n/hu.json

@@ -1641,8 +1641,6 @@
       "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "Ha a zászló engedélyezve van, képes leszel egyetlen munkamenetet megszüntetni a bejelentkezési UI-ben, ha egy id_tokent biztosítasz egy `sid` claim-mel mint id_token_hint az end_session végpontnál. Megjegyzendő, hogy jelenleg az összes munkamenet ugyanabból a felhasználói ügynökből (böngésző) leállításra kerül a bejelentkezési UI-ben. A Session API-val kezelt munkamenetek már lehetővé teszik egyes munkamenetek megszüntetését.",
       "DEBUGOIDCPARENTERROR": "Debug OIDC Parent Error",
       "DEBUGOIDCPARENTERROR_DESCRIPTION": "Ha a zászló engedélyezve van, az OIDC szülő hiba naplózva lesz a konzolban.",
-      "ENABLEBACKCHANNELLOGOUT": "Backchannel Logout engedélyezése",
-      "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "A Back-Channel Logout megvalósítja az OpenID Connect Back-Channel Logout 1.0-t, és használható az alkalmazások értesítésére a munkamenet befejezéséről az OpenID szolgáltatónál.",
       "PERMISSIONCHECKV2": "Engedély ellenőrzés V2",
       "PERMISSIONCHECKV2_DESCRIPTION": "Ha a zászló engedélyezve van, használhatja az új API-t és annak funkcióit.",
       "STATES": {

console/src/assets/i18n/id.json

@@ -1640,8 +1640,6 @@
       "ACTIONS": "Tindakan",
       "ACTIONS_DESCRIPTION": "Tindakan v2 memungkinkan untuk mengelola eksekusi dan target data. Jika tanda ini diaktifkan, Anda akan dapat menggunakan API baru dan fitur-fiturnya.",
       "DEBUGOIDCPARENTERROR_DESCRIPTION": "If the flag is enabled, the OIDC parent error will be logged in the console.",
-      "ENABLEBACKCHANNELLOGOUT": "Enable Backchannel Logout",
-      "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "The Back-Channel Logout implements OpenID Connect Back-Channel Logout 1.0 and can be used to notify applications about session termination at the OpenID Provider.",
       "PERMISSIONCHECKV2": "Permission Check V2",
       "PERMISSIONCHECKV2_DESCRIPTION": "If the flag is enabled, you'll be able to use the new API and its features.",
       "STATES": {

console/src/assets/i18n/it.json

@@ -1643,8 +1643,6 @@
       "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "Se il flag è abilitato, sarai in grado di terminare una singola sessione dall'interfaccia utente di accesso fornendo un id_token con una richiesta `sid` come id_token_hint nel punto finale di end_session. Tieni presente che attualmente tutte le sessioni dello stesso agente utente (browser) vengono terminate nell'interfaccia utente di accesso. Le sessioni gestite tramite l'API di sessione consentono già la terminazione di singole sessioni.",
       "DEBUGOIDCPARENTERROR": "Debug OIDC Parent Error",
       "DEBUGOIDCPARENTERROR_DESCRIPTION": "Se il flag è abilitato, l'errore OIDC originante verrà registrato nella console.",
-      "ENABLEBACKCHANNELLOGOUT": "Abilita Backchannel Logout",
-      "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "Il Back-Channel Logout implementa OpenID Connect Back-Channel Logout 1.0 e può essere utilizzato per notificare alle applicazioni la terminazione della sessione presso il provider OpenID.",
       "PERMISSIONCHECKV2": "Controllo permessi V2",
       "PERMISSIONCHECKV2_DESCRIPTION": "Se il flag è abilitato, potrai utilizzare la nuova API e le sue funzionalità.",
       "STATES": {

console/src/assets/i18n/ja.json

@@ -1643,8 +1643,6 @@
       "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "フラグが有効になっている場合、id_token を `sid` クレームと共に id_token_hint として end_session エンドポイントに提供することで、ログイン UI から単一のセッションを終了できるようになります。 現在、同じユーザー エージェント (ブラウザ) からのすべてのセッションがログイン UI で終了することに注意してください。 セッション API を通じて管理されるセッションは、すでに単一のセッションの終了を許可しています。",
       "DEBUGOIDCPARENTERROR": "デバッグ OIDC 親エラー",
       "DEBUGOIDCPARENTERROR_DESCRIPTION": "フラグが有効になっている場合、OIDC 親エラーはコンソールに記録されます。",
-      "ENABLEBACKCHANNELLOGOUT": "バックチャネルログアウトを有効にする",
-      "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "バックチャネルログアウトは OpenID Connect バックチャネルログアウト 1.0 を実装し、OpenID プロバイダーでのセッション終了についてアプリケーションに通知するために使用できます。",
       "PERMISSIONCHECKV2": "権限チェック V2",
       "PERMISSIONCHECKV2_DESCRIPTION": "フラグが有効になっている場合、新しい API とその機能を使用できます。",
       "STATES": {

console/src/assets/i18n/ko.json

@@ -1643,8 +1643,6 @@
       "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "플래그가 활성화되면, `sid` 클레임이 있는 id_token을 사용하여 end_session 엔드포인트에서 로그인 UI의 단일 세션을 종료할 수 있습니다. 현재 동일한 사용자 에이전트(브라우저)에서 모든 세션이 로그인 UI에서 종료됩니다. Session API를 통해 관리된 세션은 이미 단일 세션 종료를 허용합니다.",
       "DEBUGOIDCPARENTERROR": "디버그 OIDC 부모 오류",
       "DEBUGOIDCPARENTERROR_DESCRIPTION": "플래그가 활성화되면 OIDC 부모 오류가 콘솔에 기록됩니다.",
-      "ENABLEBACKCHANNELLOGOUT": "백채널 로그아웃 활성화",
-      "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "백채널 로그아웃은 OpenID Connect 백채널 로그아웃 1.0을 구현하며, OpenID 제공자에서 세션 종료에 대해 애플리케이션에게 알리는 데 사용할 수 있습니다.",
       "PERMISSIONCHECKV2": "권한 확인 V2",
       "PERMISSIONCHECKV2_DESCRIPTION": "플래그가 활성화되면 새로운 API와 그 기능을 사용할 수 있습니다.",
       "STATES": {

console/src/assets/i18n/mk.json

@@ -1644,8 +1644,6 @@
       "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "Ако ознаката е активирана, ќе можете да ја завршите единечна сесија од корисничкиот интерфејс за најава, со обезбедување id_token со `sid` побарување како id_token_hint на крајната точка на end_session. Имајте предвид дека во моментов сите сесии од истиот кориснички агент (прелистувач) се завршуваат во корисничкиот интерфејс за најава. Сесиите управувани преку API на сесија веќе дозволуваат завршување на единечни сесии.",
       "DEBUGOIDCPARENTERROR": "Дебагирање на OIDC родителска грешка",
       "DEBUGOIDCPARENTERROR_DESCRIPTION": "Ако знамето е овозможено, грешката на OIDC родителот ќе биде регистрирана во конзолата.",
-      "ENABLEBACKCHANNELLOGOUT": "Овозможи Backchannel Logout",
-      "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "Back-Channel Logout имплементира OpenID Connect Back-Channel Logout 1.0 и може да се користи за известување на апликациите за завршување на сесијата кај OpenID провајдерот.",
       "PERMISSIONCHECKV2": "Проверка на дозволи V2",
       "PERMISSIONCHECKV2_DESCRIPTION": "Ако знамето е овозможено, ќе можете да ја користите новата API и нејзините функции.",
       "STATES": {

console/src/assets/i18n/nl.json

@@ -1643,8 +1643,6 @@
       "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "Als het vlagje is ingeschakeld, kunt u een enkele sessie beëindigen via de login-gebruikersinterface door een id_token met een `sid`-claim als id_token_hint op het eindpunt end_session te verstrekken. Houd er rekening mee dat momenteel alle sessies van dezelfde gebruikersagent (browser) worden beëindigd in de login-gebruikersinterface. Sessies die worden beheerd via de Session API staan al toe om individuele sessies te beëindigen.",
       "DEBUGOIDCPARENTERROR": "Debug OIDC Ouderfout",
       "DEBUGOIDCPARENTERROR_DESCRIPTION": "Als de vlag is ingeschakeld, wordt de OIDC-ouderfout in de console geregistreerd.",
-      "ENABLEBACKCHANNELLOGOUT": "Backchannel Logout inschakelen",
-      "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "De Back-Channel Logout implementeert OpenID Connect Back-Channel Logout 1.0 en kan worden gebruikt om applicaties te informeren over het beëindigen van de sessie bij de OpenID-provider.",
       "PERMISSIONCHECKV2": "Permissiecontrole V2",
       "PERMISSIONCHECKV2_DESCRIPTION": "Als de vlag is ingeschakeld, kunt u de nieuwe API en de bijbehorende functies gebruiken.",
       "STATES": {

console/src/assets/i18n/pl.json

@@ -1642,8 +1642,6 @@
       "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "Jeśli flaga jest włączona, będziesz mógł zakończyć pojedynczą sesję z interfejsu użytkownika logowania, podając id_token z roszczeniem `sid` jako id_token_hint w punkcie końcowym end_session. Należy pamiętać, że obecnie wszystkie sesje z tego samego agenta użytkownika (przeglądarki) są kończone w interfejsie użytkownika logowania. Sesje zarządzane za pomocą interfejsu API sesji już pozwalają na zakończenie pojedynczych sesji.",
       "DEBUGOIDCPARENTERROR": "Debug OIDC Błąd nadrzędny",
       "DEBUGOIDCPARENTERROR_DESCRIPTION": "Jeśli flaga jest włączona, błąd nadrzędny OIDC zostanie zarejestrowany w konsoli.",
-      "ENABLEBACKCHANNELLOGOUT": "Włącz Backchannel Logout",
-      "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "Back-Channel Logout implementuje OpenID Connect Back-Channel Logout 1.0 i może być używany do powiadamiania aplikacji o zakończeniu sesji u dostawcy OpenID.",
       "PERMISSIONCHECKV2": "Sprawdzanie uprawnień V2",
       "PERMISSIONCHECKV2_DESCRIPTION": "Jeśli flaga jest włączona, będziesz mógł korzystać z nowego API i jego funkcji.",
       "STATES": {

console/src/assets/i18n/pt.json

@@ -1644,8 +1644,6 @@
       "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "Se a bandeira estiver habilitada, você poderá encerrar uma sessão única da interface do usuário de login fornecendo um id_token com uma reivindicação `sid como id_token_hint no ponto final de end_session. Observe que atualmente todas as sessões do mesmo agente de usuário (navegador) são encerradas na interface do usuário de login. As sessões gerenciadas por meio da API de sessão já permitem o encerramento de sessões individuais.",
       "DEBUGOIDCPARENTERROR": "Erro de Depuração do Pai OIDC",
       "DEBUGOIDCPARENTERROR_DESCRIPTION": "Se a bandeira estiver ativada, o erro do pai OIDC será registrado no console.",
-      "ENABLEBACKCHANNELLOGOUT": "Ativar Logout de Backchannel",
-      "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "O Logout de Back-Channel implementa o OpenID Connect Back-Channel Logout 1.0 e pode ser usado para notificar os aplicativos sobre a terminação da sessão no Provedor de OpenID.",
       "PERMISSIONCHECKV2": "Verificação de Permissão V2",
       "PERMISSIONCHECKV2_DESCRIPTION": "Se a bandeira estiver ativada, você poderá usar a nova API e seus recursos.",
       "STATES": {

console/src/assets/i18n/ro.json

@@ -1641,8 +1641,6 @@
       "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "Dacă indicatorul este activat, veți putea termina o singură sesiune din UI-ul de conectare furnizând un id_token cu o revendicare sid ca id_token_hint pe endpointul end_session. Rețineți că în prezent toate sesiunile de la același agent utilizator (browser) sunt terminate în UI-ul de conectare. Sesiunile gestionate prin API-ul Session permit deja terminarea sesiunilor individuale.",
       "DEBUGOIDCPARENTERROR": "Eroare de Depanare Părinte OIDC",
       "DEBUGOIDCPARENTERROR_DESCRIPTION": "Dacă steagul este activat, eroarea părinte OIDC va fi înregistrată în consolă.",
-      "ENABLEBACKCHANNELLOGOUT": "Activează Logout Backchannel",
-      "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "Logout-ul Back-Channel implementează OpenID Connect Back-Channel Logout 1.0 și poate fi folosit pentru a notifica aplicațiile despre terminarea sesiunii la Producătorul OpenID.",
       "PERMISSIONCHECKV2": "Verificare Permisiuni V2",
       "PERMISSIONCHECKV2_DESCRIPTION": "Dacă steagul este activat, veți putea folosi noua API și funcțiile sale.",
       "STATES": {

console/src/assets/i18n/ru.json

@@ -1704,8 +1704,6 @@
       "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "Если флаг включен, вы сможете завершить отдельный сеанс из интерфейса пользователя входа, предоставив id_token с претензией `sid` в качестве id_token_hint на конечной точке end_session. Обратите внимание, что в настоящее время все сеансы одного и того же пользовательского агента (браузера) завершаются в интерфейсе пользователя входа. Сеансы, управляемые через API сеанса, уже позволяют завершать отдельные сеансы.",
       "DEBUGOIDCPARENTERROR": "Отладка Ошибки Родителя OIDC",
       "DEBUGOIDCPARENTERROR_DESCRIPTION": "Если флаг включен, ошибка родителя OIDC будет записана в консоль.",
-      "ENABLEBACKCHANNELLOGOUT": "Включить Backchannel Logout",
-      "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "Back-Channel Logout реализует OpenID Connect Back-Channel Logout 1.0 и может использоваться для уведомления приложений о завершении сеанса у поставщика OpenID.",
       "PERMISSIONCHECKV2": "Проверка Разрешений V2",
       "PERMISSIONCHECKV2_DESCRIPTION": "Если флаг включен, вы сможете использовать новый API и его функции.",
       "STATES": {

console/src/assets/i18n/sv.json

@@ -1647,8 +1647,6 @@
       "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "Om flaggan är aktiverad, kan du avsluta en enskild session från inloggningsgränssnittet genom att ange en id_token med ett `sid`-krav som id_token_hint på slutpunkten end_session. Observera att för närvarande alla sessioner från samma användaragent (webbläsare) avslutas i inloggningsgränssnittet. Sessioner som hanteras via Session API tillåter redan avslutning av enskilda sessioner.",
       "DEBUGOIDCPARENTERROR": "Debugga OIDC Föräldrafel",
       "DEBUGOIDCPARENTERROR_DESCRIPTION": "Om flaggan är aktiverad kommer OIDC-föräldrafel att loggas i konsolen.",
-      "ENABLEBACKCHANNELLOGOUT": "Aktivera Backchannel Logout",
-      "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "Back-Channel Logout implementerar OpenID Connect Back-Channel Logout 1.0 och kan användas för att meddela applikationer om sessionens avslutning hos OpenID-leverantören.",
       "PERMISSIONCHECKV2": "Behörighetskontroll V2",
       "PERMISSIONCHECKV2_DESCRIPTION": "Om flaggan är aktiverad kan du använda den nya API:n och dess funktioner.",
       "STATES": {

console/src/assets/i18n/tr.json

@@ -1646,8 +1646,6 @@
       "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "Bayrak etkinleştirilirse, end_session uç noktasında id_token_hint olarak `sid` iddiası olan bir id_token sağlayarak giriş UI'ından tek bir oturumu sonlandırabileceksiniz. Şu anda giriş UI'ında aynı kullanıcı aracısından (tarayıcı) tüm oturumların sonlandırıldığını unutmayın. Oturum API'si aracılığıyla yönetilen oturumlar zaten tek oturumların sonlandırılmasına izin veriyor.",
       "DEBUGOIDCPARENTERROR": "OIDC Üst Hatayı Hata Ayıkla",
       "DEBUGOIDCPARENTERROR_DESCRIPTION": "Bayrak etkinleştirilirse, OIDC üst hatası konsolda günlüğe kaydedilecektir.",
-      "ENABLEBACKCHANNELLOGOUT": "Arka Kanal Çıkışını Etkinleştir",
-      "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "Arka Kanal Çıkışı OpenID Connect Arka Kanal Çıkışı 1.0'ı uygular ve OpenID Sağlayıcısında oturum sonlandırma hakkında uygulamaları bilgilendirmek için kullanılabilir.",
       "PERMISSIONCHECKV2": "İzin Kontrolü V2",
       "PERMISSIONCHECKV2_DESCRIPTION": "Bayrak etkinleştirilirse, yeni API'yi ve özelliklerini kullanabileceksiniz.",
       "STATES": {

console/src/assets/i18n/uk.json

@@ -1647,8 +1647,6 @@
       "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "Якщо прапорець увімкнено, ви зможете завершити одиночну сесію з інтерфейсу входу, надавши id_token з претензією `sid` як id_token_hint на кінцевій точці end_session. Зверніть увагу, що наразі всі сесії з того ж агента користувача (браузера) завершуються в інтерфейсі входу. Сесії, керовані через Session API, вже дозволяють завершення одиночних сесій.",
       "DEBUGOIDCPARENTERROR": "Налагодження батьківської помилки OIDC",
       "DEBUGOIDCPARENTERROR_DESCRIPTION": "Якщо прапорець увімкнено, батьківська помилка OIDC буде записана в консоль.",
-      "ENABLEBACKCHANNELLOGOUT": "Увімкнути вихід через зворотний канал",
-      "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "Вихід через зворотний канал реалізує OpenID Connect Back-Channel Logout 1.0 і може використовуватися для сповіщення додатків про завершення сесії у провайдера OpenID.",
       "PERMISSIONCHECKV2": "Перевірка дозволів V2",
       "PERMISSIONCHECKV2_DESCRIPTION": "Якщо прапорець увімкнено, ви зможете використовувати новий API та його можливості.",
       "STATES": {

console/src/assets/i18n/zh.json

@@ -1646,8 +1646,6 @@
       "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "如果启用了标志，您可以通过在 end_session 端点上提供带有 `sid` 声明的 id_token 作为 id_token_hint 来从登录 UI 终止单个会话。 请注意，目前所有来自同一用户代理（浏览器）的会话都在登录 UI 中终止。 通过会话 API 管理的会话已经允许终止单个会话。",
       "DEBUGOIDCPARENTERROR": "调试 OIDC 父错误",
       "DEBUGOIDCPARENTERROR_DESCRIPTION": "如果启用该标志，OIDC 父错误将记录在控制台中。",
-      "ENABLEBACKCHANNELLOGOUT": "启用 Backchannel 注销",
-      "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "Back-Channel 注销实现了 OpenID Connect Back-Channel Logout 1.0，可用于通知应用程序在 OpenID 提供商处终止会话。",
       "PERMISSIONCHECKV2": "权限检查 V2",
       "PERMISSIONCHECKV2_DESCRIPTION": "如果启用该标志，您将能够使用新的 API 及其功能。",
       "STATES": {

internal/api/grpc/feature/v2/converter.go

@@ -22,7 +22,6 @@ func systemFeaturesToCommand(req *feature_pb.SetSystemFeaturesRequest) (*command
 		UserSchema:                     req.UserSchema,
 		ImprovedPerformance:            improvedPerformanceListToDomain(req.ImprovedPerformance),
 		OIDCSingleV1SessionTermination: req.OidcSingleV1SessionTermination,
-		EnableBackChannelLogout:        req.EnableBackChannelLogout,
 		LoginV2:                        loginV2,
 		PermissionCheckV2:              req.PermissionCheckV2,
 		EnableRelationalTables:         req.EnableRelationalTables,
@@ -40,10 +39,13 @@ func systemFeaturesToPb(f *query.SystemFeatures) *feature_pb.GetSystemFeaturesRe
 		},
 		ImprovedPerformance:            featureSourceToImprovedPerformanceFlagPb(&f.ImprovedPerformance),
 		OidcSingleV1SessionTermination: featureSourceToFlagPb(&f.OIDCSingleV1SessionTermination),
-		EnableBackChannelLogout:        featureSourceToFlagPb(&f.EnableBackChannelLogout),
-		LoginV2:                        loginV2ToLoginV2FlagPb(f.LoginV2),
-		PermissionCheckV2:              featureSourceToFlagPb(&f.PermissionCheckV2),
-		EnableRelationalTables:         featureSourceToFlagPb(&f.EnableRelationalTables),
+		EnableBackChannelLogout: &feature_pb.FeatureFlag{ // TODO: remove in next major version
+			Enabled: true,
+			Source:  feature_pb.Source_SOURCE_SYSTEM,
+		},
+		LoginV2:                loginV2ToLoginV2FlagPb(f.LoginV2),
+		PermissionCheckV2:      featureSourceToFlagPb(&f.PermissionCheckV2),
+		EnableRelationalTables: featureSourceToFlagPb(&f.EnableRelationalTables),
 	}
 }
 
@@ -58,7 +60,6 @@ func instanceFeaturesToCommand(req *feature_pb.SetInstanceFeaturesRequest) (*com
 		ImprovedPerformance:            improvedPerformanceListToDomain(req.ImprovedPerformance),
 		DebugOIDCParentError:           req.DebugOidcParentError,
 		OIDCSingleV1SessionTermination: req.OidcSingleV1SessionTermination,
-		EnableBackChannelLogout:        req.EnableBackChannelLogout,
 		LoginV2:                        loginV2,
 		PermissionCheckV2:              req.PermissionCheckV2,
 		ManagementConsoleUseV2UserApi:  req.ConsoleUseV2UserApi,
@@ -78,11 +79,14 @@ func instanceFeaturesToPb(f *query.InstanceFeatures) *feature_pb.GetInstanceFeat
 		ImprovedPerformance:            featureSourceToImprovedPerformanceFlagPb(&f.ImprovedPerformance),
 		DebugOidcParentError:           featureSourceToFlagPb(&f.DebugOIDCParentError),
 		OidcSingleV1SessionTermination: featureSourceToFlagPb(&f.OIDCSingleV1SessionTermination),
-		EnableBackChannelLogout:        featureSourceToFlagPb(&f.EnableBackChannelLogout),
-		LoginV2:                        loginV2ToLoginV2FlagPb(f.LoginV2),
-		PermissionCheckV2:              featureSourceToFlagPb(&f.PermissionCheckV2),
-		ConsoleUseV2UserApi:            featureSourceToFlagPb(&f.ManagementConsoleUseV2UserApi),
-		EnableRelationalTables:         featureSourceToFlagPb(&f.EnableRelationalTables),
+		EnableBackChannelLogout: &feature_pb.FeatureFlag{ // TODO: remove in next major version
+			Enabled: true,
+			Source:  feature_pb.Source_SOURCE_SYSTEM,
+		},
+		LoginV2:                loginV2ToLoginV2FlagPb(f.LoginV2),
+		PermissionCheckV2:      featureSourceToFlagPb(&f.PermissionCheckV2),
+		ConsoleUseV2UserApi:    featureSourceToFlagPb(&f.ManagementConsoleUseV2UserApi),
+		EnableRelationalTables: featureSourceToFlagPb(&f.EnableRelationalTables),
 	}
 }
 

internal/api/grpc/feature/v2/converter_test.go

@@ -29,9 +29,8 @@ func Test_systemFeaturesToCommand(t *testing.T) {
 			Required: true,
 			BaseUri:  gu.Ptr("https://login.com"),
 		},
-		EnableRelationalTables:  gu.Ptr(true),
-		EnableBackChannelLogout: gu.Ptr(true),
-		PermissionCheckV2:       gu.Ptr(true),
+		EnableRelationalTables: gu.Ptr(true),
+		PermissionCheckV2:      gu.Ptr(true),
 	}
 	want := &command.SystemFeatures{
 		LoginDefaultOrg:                gu.Ptr(true),
@@ -42,9 +41,8 @@ func Test_systemFeaturesToCommand(t *testing.T) {
 			Required: true,
 			BaseURI:  &url.URL{Scheme: "https", Host: "login.com"},
 		},
-		EnableRelationalTables:  gu.Ptr(true),
-		EnableBackChannelLogout: gu.Ptr(true),
-		PermissionCheckV2:       gu.Ptr(true),
+		EnableRelationalTables: gu.Ptr(true),
+		PermissionCheckV2:      gu.Ptr(true),
 	}
 
 	// Test
@@ -81,10 +79,6 @@ func Test_systemFeaturesToPb(t *testing.T) {
 			Level: feature.LevelSystem,
 			Value: true,
 		},
-		EnableBackChannelLogout: query.FeatureSource[bool]{
-			Level: feature.LevelSystem,
-			Value: true,
-		},
 		LoginV2: query.FeatureSource[*feature.LoginV2]{
 			Level: feature.LevelSystem,
 			Value: &feature.LoginV2{
@@ -162,7 +156,6 @@ func Test_instanceFeaturesToCommand(t *testing.T) {
 		ImprovedPerformance:            nil,
 		DebugOidcParentError:           gu.Ptr(true),
 		OidcSingleV1SessionTermination: gu.Ptr(true),
-		EnableBackChannelLogout:        gu.Ptr(true),
 		LoginV2: &feature_pb.LoginV2{
 			Required: true,
 			BaseUri:  gu.Ptr("https://login.com"),
@@ -177,7 +170,6 @@ func Test_instanceFeaturesToCommand(t *testing.T) {
 		ImprovedPerformance:            nil,
 		DebugOIDCParentError:           gu.Ptr(true),
 		OIDCSingleV1SessionTermination: gu.Ptr(true),
-		EnableBackChannelLogout:        gu.Ptr(true),
 		LoginV2: &feature.LoginV2{
 			Required: true,
 			BaseURI:  &url.URL{Scheme: "https", Host: "login.com"},
@@ -220,10 +212,6 @@ func Test_instanceFeaturesToPb(t *testing.T) {
 			Level: feature.LevelInstance,
 			Value: true,
 		},
-		EnableBackChannelLogout: query.FeatureSource[bool]{
-			Level: feature.LevelInstance,
-			Value: true,
-		},
 		LoginV2: query.FeatureSource[*feature.LoginV2]{
 			Level: feature.LevelInstance,
 			Value: &feature.LoginV2{
@@ -276,7 +264,7 @@ func Test_instanceFeaturesToPb(t *testing.T) {
 		},
 		EnableBackChannelLogout: &feature_pb.FeatureFlag{
 			Enabled: true,
-			Source:  feature_pb.Source_SOURCE_INSTANCE,
+			Source:  feature_pb.Source_SOURCE_SYSTEM,
 		},
 		LoginV2: &feature_pb.LoginV2FeatureFlag{
 			Required: true,

internal/api/oidc/server.go

@@ -178,7 +178,6 @@ func (s *Server) EndSession(ctx context.Context, r *op.Request[oidc.EndSessionRe
 
 func (s *Server) createDiscoveryConfig(ctx context.Context, supportedUILocales oidc.Locales) *oidc.DiscoveryConfiguration {
 	issuer := op.IssuerFromContext(ctx)
-	backChannelLogoutSupported := authz.GetInstance(ctx).Features().EnableBackChannelLogout
 
 	return &oidc.DiscoveryConfiguration{
 		Issuer:                      issuer,
@@ -211,8 +210,8 @@ func (s *Server) createDiscoveryConfig(ctx context.Context, supportedUILocales o
 		CodeChallengeMethodsSupported:                      op.CodeChallengeMethods(s.Provider()),
 		UILocalesSupported:                                 supportedUILocales,
 		RequestParameterSupported:                          s.Provider().RequestObjectSupported(),
-		BackChannelLogoutSupported:                         backChannelLogoutSupported,
-		BackChannelLogoutSessionSupported:                  backChannelLogoutSupported,
+		BackChannelLogoutSupported:                         true,
+		BackChannelLogoutSessionSupported:                  true,
 	}
 }
 

internal/api/oidc/server_test.go

@@ -106,6 +106,8 @@ func TestServer_createDiscoveryConfig(t *testing.T) {
 				RequireRequestURIRegistration:                      false,
 				OPPolicyURI:                                        "",
 				OPTermsOfServiceURI:                                "",
+				BackChannelLogoutSupported:                         true,
+				BackChannelLogoutSessionSupported:                  true,
 			},
 		},
 	}

internal/command/device_auth_test.go

@@ -19,7 +19,6 @@ import (
 	"github.com/zitadel/zitadel/internal/crypto"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/eventstore"
-	"github.com/zitadel/zitadel/internal/feature"
 	"github.com/zitadel/zitadel/internal/id"
 	"github.com/zitadel/zitadel/internal/id/mock"
 	"github.com/zitadel/zitadel/internal/repository/deviceauth"
@@ -1088,7 +1087,7 @@ func TestCommands_CreateOIDCSessionFromDeviceAuth(t *testing.T) {
 			},
 		},
 		{
-			name: "approved with backChannelLogout (feature enabled), success",
+			name: "approved with backChannelLogout, success",
 			fields: fields{
 				eventstore: expectEventstore(
 					expectFilter(
@@ -1167,9 +1166,7 @@ func TestCommands_CreateOIDCSessionFromDeviceAuth(t *testing.T) {
 				keyAlgorithm:                    crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
-				authz.WithFeatures(ctx, feature.Features{
-					EnableBackChannelLogout: true,
-				}),
+				ctx,
 				"123",
 				"backChannelLogoutURI",
 			},

internal/command/instance.go

@@ -136,7 +136,6 @@ type InstanceSetupFeatures struct {
 	ImprovedPerformance            []feature.ImprovedPerformanceType
 	DebugOIDCParentError           *bool
 	OIDCSingleV1SessionTermination *bool
-	EnableBackChannelLogout        *bool
 	LoginV2                        *InstanceSetupFeatureLoginV2
 	PermissionCheckV2              *bool
 	ManagementConsoleUseV2UserApi  *bool
@@ -169,7 +168,6 @@ func (f *InstanceSetupFeatures) ToInstanceFeatures() (_ *InstanceFeatures, err e
 		ImprovedPerformance:            f.ImprovedPerformance,
 		DebugOIDCParentError:           f.DebugOIDCParentError,
 		OIDCSingleV1SessionTermination: f.OIDCSingleV1SessionTermination,
-		EnableBackChannelLogout:        f.EnableBackChannelLogout,
 		LoginV2:                        loginV2,
 		PermissionCheckV2:              f.PermissionCheckV2,
 		ManagementConsoleUseV2UserApi:  f.ManagementConsoleUseV2UserApi,

internal/command/instance_features.go

@@ -18,7 +18,6 @@ type InstanceFeatures struct {
 	ImprovedPerformance            []feature.ImprovedPerformanceType
 	DebugOIDCParentError           *bool
 	OIDCSingleV1SessionTermination *bool
-	EnableBackChannelLogout        *bool
 	LoginV2                        *feature.LoginV2
 	PermissionCheckV2              *bool
 	ManagementConsoleUseV2UserApi  *bool
@@ -32,7 +31,6 @@ func (m *InstanceFeatures) isEmpty() bool {
 		m.ImprovedPerformance == nil &&
 		m.DebugOIDCParentError == nil &&
 		m.OIDCSingleV1SessionTermination == nil &&
-		m.EnableBackChannelLogout == nil &&
 		m.LoginV2 == nil &&
 		m.PermissionCheckV2 == nil &&
 		m.ManagementConsoleUseV2UserApi == nil &&

internal/command/instance_features_model.go

@@ -71,7 +71,6 @@ func (m *InstanceFeaturesWriteModel) Query() *eventstore.SearchQueryBuilder {
 			feature_v2.InstanceImprovedPerformanceEventType,
 			feature_v2.InstanceDebugOIDCParentErrorEventType,
 			feature_v2.InstanceOIDCSingleV1SessionTerminationEventType,
-			feature_v2.InstanceEnableBackChannelLogout,
 			feature_v2.InstanceLoginVersion,
 			feature_v2.InstancePermissionCheckV2,
 			feature_v2.InstanceManagementConsoleUseV2UserApi,
@@ -103,9 +102,6 @@ func reduceInstanceFeature(features *InstanceFeatures, key feature.Key, value an
 	case feature.KeyOIDCSingleV1SessionTermination:
 		v := value.(bool)
 		features.OIDCSingleV1SessionTermination = &v
-	case feature.KeyEnableBackChannelLogout:
-		v := value.(bool)
-		features.EnableBackChannelLogout = &v
 	case feature.KeyLoginV2:
 		features.LoginV2 = value.(*feature.LoginV2)
 	case feature.KeyPermissionCheckV2:
@@ -128,7 +124,6 @@ func (wm *InstanceFeaturesWriteModel) setCommands(ctx context.Context, f *Instan
 	cmds = appendFeatureSliceUpdate(ctx, cmds, aggregate, wm.ImprovedPerformance, f.ImprovedPerformance, feature_v2.InstanceImprovedPerformanceEventType)
 	cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.DebugOIDCParentError, f.DebugOIDCParentError, feature_v2.InstanceDebugOIDCParentErrorEventType)
 	cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.OIDCSingleV1SessionTermination, f.OIDCSingleV1SessionTermination, feature_v2.InstanceOIDCSingleV1SessionTerminationEventType)
-	cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.EnableBackChannelLogout, f.EnableBackChannelLogout, feature_v2.InstanceEnableBackChannelLogout)
 	cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.LoginV2, f.LoginV2, feature_v2.InstanceLoginVersion)
 	cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.PermissionCheckV2, f.PermissionCheckV2, feature_v2.InstancePermissionCheckV2)
 	cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.ManagementConsoleUseV2UserApi, f.ManagementConsoleUseV2UserApi, feature_v2.InstanceManagementConsoleUseV2UserApi)

internal/command/instance_features_model_test.go

@@ -74,15 +74,6 @@ func Test_reduceInstanceFeature(t *testing.T) {
 			},
 			expected: &InstanceFeatures{OIDCSingleV1SessionTermination: gu.Ptr(true)},
 		},
-		{
-			name: "enable back channel logout",
-			args: args{
-				features: &InstanceFeatures{},
-				key:      feature.KeyEnableBackChannelLogout,
-				value:    true,
-			},
-			expected: &InstanceFeatures{EnableBackChannelLogout: gu.Ptr(true)},
-		},
 		{
 			name: "login v2",
 			args: args{

internal/command/instance_test.go

@@ -1779,7 +1779,6 @@ func TestInstanceSetupFeatures_ToInstanceFeatures(t *testing.T) {
 		ImprovedPerformance            []feature.ImprovedPerformanceType
 		DebugOIDCParentError           *bool
 		OIDCSingleV1SessionTermination *bool
-		EnableBackChannelLogout        *bool
 		LoginV2                        *InstanceSetupFeatureLoginV2
 		PermissionCheckV2              *bool
 		ManagementConsoleUseV2UserApi  *bool
@@ -1808,7 +1807,6 @@ func TestInstanceSetupFeatures_ToInstanceFeatures(t *testing.T) {
 				ImprovedPerformance:            []feature.ImprovedPerformanceType{feature.ImprovedPerformanceTypeOrgDomainVerified},
 				DebugOIDCParentError:           gu.Ptr(true),
 				OIDCSingleV1SessionTermination: gu.Ptr(false),
-				EnableBackChannelLogout:        gu.Ptr(true),
 				PermissionCheckV2:              gu.Ptr(true),
 				ManagementConsoleUseV2UserApi:  gu.Ptr(false),
 				EnableRelationalTables:         gu.Ptr(true),
@@ -1819,7 +1817,6 @@ func TestInstanceSetupFeatures_ToInstanceFeatures(t *testing.T) {
 				ImprovedPerformance:            []feature.ImprovedPerformanceType{feature.ImprovedPerformanceTypeOrgDomainVerified},
 				DebugOIDCParentError:           gu.Ptr(true),
 				OIDCSingleV1SessionTermination: gu.Ptr(false),
-				EnableBackChannelLogout:        gu.Ptr(true),
 				LoginV2:                        nil,
 				PermissionCheckV2:              gu.Ptr(true),
 				ManagementConsoleUseV2UserApi:  gu.Ptr(false),
@@ -1875,7 +1872,6 @@ func TestInstanceSetupFeatures_ToInstanceFeatures(t *testing.T) {
 				ImprovedPerformance:            tc.fields.ImprovedPerformance,
 				DebugOIDCParentError:           tc.fields.DebugOIDCParentError,
 				OIDCSingleV1SessionTermination: tc.fields.OIDCSingleV1SessionTermination,
-				EnableBackChannelLogout:        tc.fields.EnableBackChannelLogout,
 				LoginV2:                        tc.fields.LoginV2,
 				PermissionCheckV2:              tc.fields.PermissionCheckV2,
 				ManagementConsoleUseV2UserApi:  tc.fields.ManagementConsoleUseV2UserApi,

internal/command/oidc_session.go

@@ -452,9 +452,6 @@ func (c *OIDCSessionEvents) RegisterLogout(ctx context.Context, sessionID, userI
 	if sessionID == "" || backChannelLogoutURI == "" {
 		return
 	}
-	if !authz.GetFeatures(ctx).EnableBackChannelLogout {
-		return
-	}
 
 	c.events = append(c.events, sessionlogout.NewBackChannelLogoutRegisteredEvent(
 		ctx,

internal/command/oidc_session_test.go

@@ -18,7 +18,6 @@ import (
 	"github.com/zitadel/zitadel/internal/crypto"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/eventstore"
-	"github.com/zitadel/zitadel/internal/feature"
 	"github.com/zitadel/zitadel/internal/id"
 	"github.com/zitadel/zitadel/internal/id/mock"
 	"github.com/zitadel/zitadel/internal/repository/authrequest"
@@ -554,9 +553,7 @@ func TestCommands_CreateOIDCSessionFromAuthRequest(t *testing.T) {
 			},
 			args{
 
-				ctx: authz.WithFeatures(authz.WithInstanceID(context.Background(), "instanceID"), feature.Features{
-					EnableBackChannelLogout: true,
-				}),
+				ctx:                  authz.WithInstanceID(context.Background(), "instanceID"),
 				authRequestID:        "V2_authRequestID",
 				complianceCheck:      mockAuthRequestComplianceChecker(nil),
 				needRefreshToken:     true,
@@ -1333,104 +1330,6 @@ func TestCommands_CreateOIDCSession(t *testing.T) {
 		},
 		{
 			name: "with backChannelLogoutURI and sessionID",
-			fields: fields{
-				eventstore: expectEventstore(
-					expectFilter(
-						user.NewHumanAddedEvent(
-							context.Background(),
-							&user.NewAggregate("userID", "org1").Aggregate,
-							"username",
-							"firstname",
-							"lastname",
-							"nickname",
-							"displayname",
-							language.Afrikaans,
-							domain.GenderUnspecified,
-							"email",
-							false,
-						),
-					),
-					expectFilter(), // token lifetime
-					expectPush(
-						oidcsession.NewAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate,
-							"userID", "org1", "sessionID", "clientID", []string{"audience"}, []string{"openid", "offline_access"},
-							[]domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow, "nonce", &language.Afrikaans,
-							&domain.UserAgent{
-								FingerprintID: gu.Ptr("fp1"),
-								IP:            net.ParseIP("1.2.3.4"),
-								Description:   gu.Ptr("firefox"),
-								Header:        http.Header{"foo": []string{"bar"}},
-							},
-						),
-						oidcsession.NewAccessTokenAddedEvent(context.Background(),
-							&oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate,
-							"at_accessTokenID", []string{"openid", "offline_access"}, time.Hour, domain.TokenReasonAuthRequest,
-							&domain.TokenActor{
-								UserID: "user2",
-								Issuer: "foo.com",
-							},
-						),
-					),
-				),
-				idGenerator:                     mock.NewIDGeneratorExpectIDs(t, "oidcSessionID", "accessTokenID"),
-				defaultAccessTokenLifetime:      time.Hour,
-				defaultRefreshTokenLifetime:     7 * 24 * time.Hour,
-				defaultRefreshTokenIdleLifetime: 24 * time.Hour,
-				keyAlgorithm:                    crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
-			},
-			args: args{
-				ctx:                  authz.WithInstanceID(context.Background(), "instanceID"),
-				userID:               "userID",
-				resourceOwner:        "org1",
-				clientID:             "clientID",
-				backChannelLogoutURI: "backChannelLogoutURI",
-				audience:             []string{"audience"},
-				scope:                []string{"openid", "offline_access"},
-				authMethods:          []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword},
-				authTime:             testNow,
-				nonce:                "nonce",
-				preferredLanguage:    &language.Afrikaans,
-				userAgent: &domain.UserAgent{
-					FingerprintID: gu.Ptr("fp1"),
-					IP:            net.ParseIP("1.2.3.4"),
-					Description:   gu.Ptr("firefox"),
-					Header:        http.Header{"foo": []string{"bar"}},
-				},
-				reason: domain.TokenReasonAuthRequest,
-				actor: &domain.TokenActor{
-					UserID: "user2",
-					Issuer: "foo.com",
-				},
-				needRefreshToken: false,
-				sessionID:        "sessionID",
-			},
-			want: &OIDCSession{
-				TokenID:           "V2_oidcSessionID-at_accessTokenID",
-				ClientID:          "clientID",
-				UserID:            "userID",
-				Audience:          []string{"audience"},
-				Expiration:        time.Time{}.Add(time.Hour),
-				Scope:             []string{"openid", "offline_access"},
-				AuthMethods:       []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword},
-				AuthTime:          testNow,
-				Nonce:             "nonce",
-				PreferredLanguage: &language.Afrikaans,
-				UserAgent: &domain.UserAgent{
-					FingerprintID: gu.Ptr("fp1"),
-					IP:            net.ParseIP("1.2.3.4"),
-					Description:   gu.Ptr("firefox"),
-					Header:        http.Header{"foo": []string{"bar"}},
-				},
-				Reason: domain.TokenReasonAuthRequest,
-				Actor: &domain.TokenActor{
-					UserID: "user2",
-					Issuer: "foo.com",
-				},
-				SessionID: "sessionID",
-			},
-		},
-		{
-			name: "with backChannelLogoutURI and sessionID, backchannel logout enabled",
 			fields: fields{
 				eventstore: expectEventstore(
 					expectFilter(
@@ -1484,7 +1383,7 @@ func TestCommands_CreateOIDCSession(t *testing.T) {
 				keyAlgorithm:                    crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
-				ctx:                  authz.WithFeatures(authz.WithInstanceID(context.Background(), "instanceID"), feature.Features{EnableBackChannelLogout: true}),
+				ctx:                  authz.WithInstanceID(context.Background(), "instanceID"),
 				userID:               "userID",
 				resourceOwner:        "org1",
 				clientID:             "clientID",

internal/command/system_features.go

@@ -14,7 +14,6 @@ type SystemFeatures struct {
 	UserSchema                     *bool
 	ImprovedPerformance            []feature.ImprovedPerformanceType
 	OIDCSingleV1SessionTermination *bool
-	EnableBackChannelLogout        *bool
 	LoginV2                        *feature.LoginV2
 	PermissionCheckV2              *bool
 	EnableRelationalTables         *bool
@@ -26,7 +25,6 @@ func (m *SystemFeatures) isEmpty() bool {
 		// nil check to allow unset improvements
 		m.ImprovedPerformance == nil &&
 		m.OIDCSingleV1SessionTermination == nil &&
-		m.EnableBackChannelLogout == nil &&
 		m.LoginV2 == nil &&
 		m.PermissionCheckV2 == nil &&
 		m.EnableRelationalTables == nil)

internal/command/system_features_model.go

@@ -63,7 +63,6 @@ func (m *SystemFeaturesWriteModel) Query() *eventstore.SearchQueryBuilder {
 			feature_v2.SystemUserSchemaEventType,
 			feature_v2.SystemImprovedPerformanceEventType,
 			feature_v2.SystemOIDCSingleV1SessionTerminationEventType,
-			feature_v2.SystemEnableBackChannelLogout,
 			feature_v2.SystemLoginVersion,
 			feature_v2.SystemPermissionCheckV2,
 			feature_v2.SystemEnableRelationalTables,
@@ -90,9 +89,6 @@ func reduceSystemFeature(features *SystemFeatures, key feature.Key, value any) {
 	case feature.KeyOIDCSingleV1SessionTermination:
 		v := value.(bool)
 		features.OIDCSingleV1SessionTermination = &v
-	case feature.KeyEnableBackChannelLogout:
-		v := value.(bool)
-		features.EnableBackChannelLogout = &v
 	case feature.KeyLoginV2:
 		features.LoginV2 = value.(*feature.LoginV2)
 	case feature.KeyPermissionCheckV2:
@@ -111,7 +107,6 @@ func (wm *SystemFeaturesWriteModel) setCommands(ctx context.Context, f *SystemFe
 	cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.UserSchema, f.UserSchema, feature_v2.SystemUserSchemaEventType)
 	cmds = appendFeatureSliceUpdate(ctx, cmds, aggregate, wm.ImprovedPerformance, f.ImprovedPerformance, feature_v2.SystemImprovedPerformanceEventType)
 	cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.OIDCSingleV1SessionTermination, f.OIDCSingleV1SessionTermination, feature_v2.SystemOIDCSingleV1SessionTerminationEventType)
-	cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.EnableBackChannelLogout, f.EnableBackChannelLogout, feature_v2.SystemEnableBackChannelLogout)
 	cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.LoginV2, f.LoginV2, feature_v2.SystemLoginVersion)
 	cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.PermissionCheckV2, f.PermissionCheckV2, feature_v2.SystemPermissionCheckV2)
 	cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.EnableRelationalTables, f.EnableRelationalTables, feature_v2.SystemEnableRelationalTables)

internal/command/system_features_test.go

@@ -91,12 +91,12 @@ func TestCommands_SetSystemFeatures(t *testing.T) {
 				expectPushFailed(io.ErrClosedPipe,
 					feature_v2.NewSetEvent(
 						context.Background(), aggregate,
-						feature_v2.SystemEnableBackChannelLogout, true,
+						feature_v2.SystemPermissionCheckV2, true,
 					),
 				),
 			),
 			args: args{context.Background(), &SystemFeatures{
-				EnableBackChannelLogout: gu.Ptr(true),
+				PermissionCheckV2: gu.Ptr(true),
 			}},
 			wantErr: io.ErrClosedPipe,
 		},
@@ -291,7 +291,6 @@ func TestSystemFeatures_isEmpty(t *testing.T) {
 		{name: "UserSchema set", sysFeatures: &SystemFeatures{UserSchema: gu.Ptr(true)}, want: false},
 		{name: "ImprovedPerformance set", sysFeatures: &SystemFeatures{ImprovedPerformance: []feature.ImprovedPerformanceType{}}, want: false},
 		{name: "OIDCSingleV1SessionTermination set", sysFeatures: &SystemFeatures{OIDCSingleV1SessionTermination: gu.Ptr(true)}, want: false},
-		{name: "EnableBackChannelLogout set", sysFeatures: &SystemFeatures{EnableBackChannelLogout: gu.Ptr(true)}, want: false},
 		{name: "LoginV2 set", sysFeatures: &SystemFeatures{LoginV2: &feature.LoginV2{}}, want: false},
 		{name: "PermissionCheckV2 set", sysFeatures: &SystemFeatures{PermissionCheckV2: gu.Ptr(true)}, want: false},
 		{name: "EnableRelationalTables set", sysFeatures: &SystemFeatures{EnableRelationalTables: gu.Ptr(true)}, want: false},

internal/feature/feature.go

@@ -9,7 +9,7 @@ import (
 type Key int
 
 const (
-	// Reserved: 2, 3, 5, 6, 8, 11
+	// Reserved: 2, 3, 5, 6, 8, 11, 12
 
 	KeyUnspecified                    Key = 0
 	KeyLoginDefaultOrg                Key = 1
@@ -17,7 +17,6 @@ const (
 	KeyImprovedPerformance            Key = 7
 	KeyDebugOIDCParentError           Key = 9
 	KeyOIDCSingleV1SessionTermination Key = 10
-	KeyEnableBackChannelLogout        Key = 12
 	KeyLoginV2                        Key = 13
 	KeyPermissionCheckV2              Key = 14
 	KeyManagementConsoleUseV2UserApi  Key = 15
@@ -44,7 +43,6 @@ type Features struct {
 	DebugOIDCParentError           bool                      `json:"debug_oidc_parent_error,omitempty"`
 	OIDCSingleV1SessionTermination bool                      `json:"oidc_single_v1_session_termination,omitempty"`
 	DisableUserTokenEvent          bool                      `json:"disable_user_token_event,omitempty"`
-	EnableBackChannelLogout        bool                      `json:"enable_back_channel_logout,omitempty"`
 	LoginV2                        LoginV2                   `json:"login_v2,omitempty"`
 	PermissionCheckV2              bool                      `json:"permission_check_v2,omitempty"`
 	ConsoleUseV2UserApi            bool                      `json:"console_use_v2_user_api,omitempty"`

internal/feature/key_enumer.go

@@ -16,8 +16,8 @@ const (
 	_KeyLowerName_2 = "improved_performance"
 	_KeyName_3      = "debug_oidc_parent_erroroidc_single_v1_session_termination"
 	_KeyLowerName_3 = "debug_oidc_parent_erroroidc_single_v1_session_termination"
-	_KeyName_4      = "enable_back_channel_logoutlogin_v2permission_check_v2management_console_use_v2_user_apienable_relational_tables"
-	_KeyLowerName_4 = "enable_back_channel_logoutlogin_v2permission_check_v2management_console_use_v2_user_apienable_relational_tables"
+	_KeyName_4      = "login_v2permission_check_v2management_console_use_v2_user_apienable_relational_tables"
+	_KeyLowerName_4 = "login_v2permission_check_v2management_console_use_v2_user_apienable_relational_tables"
 )
 
 var (
@@ -25,7 +25,7 @@ var (
 	_KeyIndex_1 = [...]uint8{0, 11}
 	_KeyIndex_2 = [...]uint8{0, 20}
 	_KeyIndex_3 = [...]uint8{0, 23, 57}
-	_KeyIndex_4 = [...]uint8{0, 26, 34, 53, 87, 111}
+	_KeyIndex_4 = [...]uint8{0, 8, 27, 61, 85}
 )
 
 func (i Key) String() string {
@@ -39,8 +39,8 @@ func (i Key) String() string {
 	case 9 <= i && i <= 10:
 		i -= 9
 		return _KeyName_3[_KeyIndex_3[i]:_KeyIndex_3[i+1]]
-	case 12 <= i && i <= 16:
-		i -= 12
+	case 13 <= i && i <= 16:
+		i -= 13
 		return _KeyName_4[_KeyIndex_4[i]:_KeyIndex_4[i+1]]
 	default:
 		return fmt.Sprintf("Key(%d)", i)
@@ -57,38 +57,35 @@ func _KeyNoOp() {
 	_ = x[KeyImprovedPerformance-(7)]
 	_ = x[KeyDebugOIDCParentError-(9)]
 	_ = x[KeyOIDCSingleV1SessionTermination-(10)]
-	_ = x[KeyEnableBackChannelLogout-(12)]
 	_ = x[KeyLoginV2-(13)]
 	_ = x[KeyPermissionCheckV2-(14)]
 	_ = x[KeyManagementConsoleUseV2UserApi-(15)]
 	_ = x[KeyEnableRelationalTables-(16)]
 }
 
-var _KeyValues = []Key{KeyUnspecified, KeyLoginDefaultOrg, KeyUserSchema, KeyImprovedPerformance, KeyDebugOIDCParentError, KeyOIDCSingleV1SessionTermination, KeyEnableBackChannelLogout, KeyLoginV2, KeyPermissionCheckV2, KeyManagementConsoleUseV2UserApi, KeyEnableRelationalTables}
+var _KeyValues = []Key{KeyUnspecified, KeyLoginDefaultOrg, KeyUserSchema, KeyImprovedPerformance, KeyDebugOIDCParentError, KeyOIDCSingleV1SessionTermination, KeyLoginV2, KeyPermissionCheckV2, KeyManagementConsoleUseV2UserApi, KeyEnableRelationalTables}
 
 var _KeyNameToValueMap = map[string]Key{
-	_KeyName_0[0:11]:        KeyUnspecified,
-	_KeyLowerName_0[0:11]:   KeyUnspecified,
-	_KeyName_0[11:28]:       KeyLoginDefaultOrg,
-	_KeyLowerName_0[11:28]:  KeyLoginDefaultOrg,
-	_KeyName_1[0:11]:        KeyUserSchema,
-	_KeyLowerName_1[0:11]:   KeyUserSchema,
-	_KeyName_2[0:20]:        KeyImprovedPerformance,
-	_KeyLowerName_2[0:20]:   KeyImprovedPerformance,
-	_KeyName_3[0:23]:        KeyDebugOIDCParentError,
-	_KeyLowerName_3[0:23]:   KeyDebugOIDCParentError,
-	_KeyName_3[23:57]:       KeyOIDCSingleV1SessionTermination,
-	_KeyLowerName_3[23:57]:  KeyOIDCSingleV1SessionTermination,
-	_KeyName_4[0:26]:        KeyEnableBackChannelLogout,
-	_KeyLowerName_4[0:26]:   KeyEnableBackChannelLogout,
-	_KeyName_4[26:34]:       KeyLoginV2,
-	_KeyLowerName_4[26:34]:  KeyLoginV2,
-	_KeyName_4[34:53]:       KeyPermissionCheckV2,
-	_KeyLowerName_4[34:53]:  KeyPermissionCheckV2,
-	_KeyName_4[53:87]:       KeyManagementConsoleUseV2UserApi,
-	_KeyLowerName_4[53:87]:  KeyManagementConsoleUseV2UserApi,
-	_KeyName_4[87:111]:      KeyEnableRelationalTables,
-	_KeyLowerName_4[87:111]: KeyEnableRelationalTables,
+	_KeyName_0[0:11]:       KeyUnspecified,
+	_KeyLowerName_0[0:11]:  KeyUnspecified,
+	_KeyName_0[11:28]:      KeyLoginDefaultOrg,
+	_KeyLowerName_0[11:28]: KeyLoginDefaultOrg,
+	_KeyName_1[0:11]:       KeyUserSchema,
+	_KeyLowerName_1[0:11]:  KeyUserSchema,
+	_KeyName_2[0:20]:       KeyImprovedPerformance,
+	_KeyLowerName_2[0:20]:  KeyImprovedPerformance,
+	_KeyName_3[0:23]:       KeyDebugOIDCParentError,
+	_KeyLowerName_3[0:23]:  KeyDebugOIDCParentError,
+	_KeyName_3[23:57]:      KeyOIDCSingleV1SessionTermination,
+	_KeyLowerName_3[23:57]: KeyOIDCSingleV1SessionTermination,
+	_KeyName_4[0:8]:        KeyLoginV2,
+	_KeyLowerName_4[0:8]:   KeyLoginV2,
+	_KeyName_4[8:27]:       KeyPermissionCheckV2,
+	_KeyLowerName_4[8:27]:  KeyPermissionCheckV2,
+	_KeyName_4[27:61]:      KeyManagementConsoleUseV2UserApi,
+	_KeyLowerName_4[27:61]: KeyManagementConsoleUseV2UserApi,
+	_KeyName_4[61:85]:      KeyEnableRelationalTables,
+	_KeyLowerName_4[61:85]: KeyEnableRelationalTables,
 }
 
 var _KeyNames = []string{
@@ -98,11 +95,10 @@ var _KeyNames = []string{
 	_KeyName_2[0:20],
 	_KeyName_3[0:23],
 	_KeyName_3[23:57],
-	_KeyName_4[0:26],
-	_KeyName_4[26:34],
-	_KeyName_4[34:53],
-	_KeyName_4[53:87],
-	_KeyName_4[87:111],
+	_KeyName_4[0:8],
+	_KeyName_4[8:27],
+	_KeyName_4[27:61],
+	_KeyName_4[61:85],
 }
 
 // KeyString retrieves an enum value from the enum constants string name.

internal/notification/handlers/back_channel_logout.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"slices"
 
-	"github.com/zitadel/zitadel/internal/api/authz"
 	http_util "github.com/zitadel/zitadel/internal/api/http"
 	"github.com/zitadel/zitadel/internal/eventstore"
 	"github.com/zitadel/zitadel/internal/eventstore/handler/v2"
@@ -75,17 +74,10 @@ func (u *backChannelLogoutNotifier) reduceUserSignedOut(event eventstore.Event)
 	}
 
 	return handler.NewStatement(event, func(ctx context.Context, ex handler.Executer, projectionName string) error {
-		ctx, err := u.queries.HandlerContext(ctx, event.Aggregate())
-		if err != nil {
-			return err
-		}
-		if !authz.GetFeatures(ctx).EnableBackChannelLogout {
-			return nil
-		}
 		if e.SessionID == "" {
 			return nil
 		}
-		ctx, err = u.queries.Origin(ctx, e)
+		ctx, err := u.queries.Origin(ctx, e)
 		if err != nil {
 			return err
 		}
@@ -109,14 +101,7 @@ func (u *backChannelLogoutNotifier) reduceSessionTerminated(event eventstore.Eve
 	}
 
 	return handler.NewStatement(event, func(ctx context.Context, ex handler.Executer, projectionName string) error {
-		ctx, err := u.queries.HandlerContext(ctx, event.Aggregate())
-		if err != nil {
-			return err
-		}
-		if !authz.GetFeatures(ctx).EnableBackChannelLogout {
-			return nil
-		}
-		ctx, err = u.queries.Origin(ctx, e)
+		ctx, err := u.queries.Origin(ctx, e)
 		if err != nil {
 			return err
 		}

internal/query/instance_by_domain.sql

@@ -6,14 +6,14 @@ with domain as (
 ), instance_features as (
 	select i.*
 	from domain d
-	join projections.instance_features4 i on d.instance_id = i.instance_id
+	join projections.instance_features5 i on d.instance_id = i.instance_id
 ), features as (
 	select instance_id, json_object_agg(
 		coalesce(i.key, s.key),
 		coalesce(i.value, s.value)
 	) features
 	from domain d
-	cross join projections.system_features3 s
+	cross join projections.system_features4 s
 	full outer join instance_features i using (instance_id, key)
 	group by instance_id
 ), external_domains as (

internal/query/instance_by_id.sql

@@ -4,8 +4,8 @@ with features as (
 		coalesce(i.value, s.value)
 	) features
 	from (select $1::text instance_id) x
-	cross join projections.system_features3 s
-	full outer join projections.instance_features4 i using (key, instance_id)
+	cross join projections.system_features4 s
+	full outer join projections.instance_features5 i using (key, instance_id)
 	group by instance_id
 ), external_domains as (
 	select instance_id, array_agg(domain) as domains

internal/query/instance_features.go

@@ -14,7 +14,6 @@ type InstanceFeatures struct {
 	ImprovedPerformance            FeatureSource[[]feature.ImprovedPerformanceType]
 	DebugOIDCParentError           FeatureSource[bool]
 	OIDCSingleV1SessionTermination FeatureSource[bool]
-	EnableBackChannelLogout        FeatureSource[bool]
 	LoginV2                        FeatureSource[*feature.LoginV2]
 	PermissionCheckV2              FeatureSource[bool]
 	ManagementConsoleUseV2UserApi  FeatureSource[bool]

internal/query/instance_features_model.go

@@ -67,7 +67,6 @@ func (m *InstanceFeaturesReadModel) Query() *eventstore.SearchQueryBuilder {
 			feature_v2.InstanceImprovedPerformanceEventType,
 			feature_v2.InstanceDebugOIDCParentErrorEventType,
 			feature_v2.InstanceOIDCSingleV1SessionTerminationEventType,
-			feature_v2.InstanceEnableBackChannelLogout,
 			feature_v2.InstanceLoginVersion,
 			feature_v2.InstancePermissionCheckV2,
 			feature_v2.InstanceManagementConsoleUseV2UserApi,
@@ -93,7 +92,6 @@ func (m *InstanceFeaturesReadModel) populateFromSystem() bool {
 	m.instance.UserSchema = m.system.UserSchema
 	m.instance.ImprovedPerformance = m.system.ImprovedPerformance
 	m.instance.OIDCSingleV1SessionTermination = m.system.OIDCSingleV1SessionTermination
-	m.instance.EnableBackChannelLogout = m.system.EnableBackChannelLogout
 	m.instance.LoginV2 = m.system.LoginV2
 	return true
 }
@@ -116,8 +114,6 @@ func reduceInstanceFeatureSet[T any](features *InstanceFeatures, event *feature_
 		features.DebugOIDCParentError.set(level, event.Value)
 	case feature.KeyOIDCSingleV1SessionTermination:
 		features.OIDCSingleV1SessionTermination.set(level, event.Value)
-	case feature.KeyEnableBackChannelLogout:
-		features.EnableBackChannelLogout.set(level, event.Value)
 	case feature.KeyLoginV2:
 		features.LoginV2.set(level, event.Value)
 	case feature.KeyPermissionCheckV2:

internal/query/projection/instance_features.go

@@ -14,7 +14,7 @@ import (
 )
 
 const (
-	InstanceFeatureTable = "projections.instance_features4"
+	InstanceFeatureTable = "projections.instance_features5"
 
 	InstanceFeatureInstanceIDCol   = "instance_id"
 	InstanceFeatureKeyCol          = "key"
@@ -80,10 +80,6 @@ func (*instanceFeatureProjection) Reducers() []handler.AggregateReducer {
 				Event:  feature_v2.InstanceOIDCSingleV1SessionTerminationEventType,
 				Reduce: reduceInstanceSetFeature[bool],
 			},
-			{
-				Event:  feature_v2.InstanceEnableBackChannelLogout,
-				Reduce: reduceInstanceSetFeature[bool],
-			},
 			{
 				Event:  feature_v2.InstanceLoginVersion,
 				Reduce: reduceInstanceSetFeature[*feature.LoginV2],

internal/query/projection/instance_features_test.go

@@ -38,7 +38,7 @@ func TestInstanceFeaturesProjection_reduces(t *testing.T) {
 				executer: &testExecuter{
 					executions: []execution{
 						{
-							expectedStmt: "INSERT INTO projections.instance_features4 (instance_id, key, creation_date, change_date, sequence, value) VALUES ($1, $2, $3, $4, $5, $6) ON CONFLICT (instance_id, key) DO UPDATE SET (creation_date, change_date, sequence, value) = (projections.instance_features4.creation_date, EXCLUDED.change_date, EXCLUDED.sequence, EXCLUDED.value)",
+							expectedStmt: "INSERT INTO projections.instance_features5 (instance_id, key, creation_date, change_date, sequence, value) VALUES ($1, $2, $3, $4, $5, $6) ON CONFLICT (instance_id, key) DO UPDATE SET (creation_date, change_date, sequence, value) = (projections.instance_features5.creation_date, EXCLUDED.change_date, EXCLUDED.sequence, EXCLUDED.value)",
 							expectedArgs: []interface{}{
 								"agg-id",
 								"user_schema",
@@ -69,7 +69,7 @@ func TestInstanceFeaturesProjection_reduces(t *testing.T) {
 				executer: &testExecuter{
 					executions: []execution{
 						{
-							expectedStmt: "INSERT INTO projections.instance_features4 (instance_id, key, creation_date, change_date, sequence, value) VALUES ($1, $2, $3, $4, $5, $6) ON CONFLICT (instance_id, key) DO UPDATE SET (creation_date, change_date, sequence, value) = (projections.instance_features4.creation_date, EXCLUDED.change_date, EXCLUDED.sequence, EXCLUDED.value)",
+							expectedStmt: "INSERT INTO projections.instance_features5 (instance_id, key, creation_date, change_date, sequence, value) VALUES ($1, $2, $3, $4, $5, $6) ON CONFLICT (instance_id, key) DO UPDATE SET (creation_date, change_date, sequence, value) = (projections.instance_features5.creation_date, EXCLUDED.change_date, EXCLUDED.sequence, EXCLUDED.value)",
 							expectedArgs: []interface{}{
 								"instance-id",
 								"login_default_org",
@@ -100,7 +100,7 @@ func TestInstanceFeaturesProjection_reduces(t *testing.T) {
 				executer: &testExecuter{
 					executions: []execution{
 						{
-							expectedStmt: "DELETE FROM projections.instance_features4 WHERE (instance_id = $1)",
+							expectedStmt: "DELETE FROM projections.instance_features5 WHERE (instance_id = $1)",
 							expectedArgs: []interface{}{
 								"agg-id",
 							},
@@ -126,7 +126,7 @@ func TestInstanceFeaturesProjection_reduces(t *testing.T) {
 				executer: &testExecuter{
 					executions: []execution{
 						{
-							expectedStmt: "DELETE FROM projections.instance_features4 WHERE (instance_id = $1)",
+							expectedStmt: "DELETE FROM projections.instance_features5 WHERE (instance_id = $1)",
 							expectedArgs: []interface{}{
 								"agg-id",
 							},

internal/query/projection/system_features.go

@@ -12,7 +12,7 @@ import (
 )
 
 const (
-	SystemFeatureTable = "projections.system_features3"
+	SystemFeatureTable = "projections.system_features4"
 
 	SystemFeatureKeyCol          = "key"
 	SystemFeatureCreationDateCol = "creation_date"
@@ -64,10 +64,6 @@ func (*systemFeatureProjection) Reducers() []handler.AggregateReducer {
 				Event:  feature_v2.SystemImprovedPerformanceEventType,
 				Reduce: reduceSystemSetFeature[[]feature.ImprovedPerformanceType],
 			},
-			{
-				Event:  feature_v2.SystemEnableBackChannelLogout,
-				Reduce: reduceSystemSetFeature[bool],
-			},
 			{
 				Event:  feature_v2.SystemLoginVersion,
 				Reduce: reduceSystemSetFeature[*feature.LoginV2],

internal/query/projection/system_features_test.go

@@ -36,7 +36,7 @@ func TestSystemFeaturesProjection_reduces(t *testing.T) {
 				executer: &testExecuter{
 					executions: []execution{
 						{
-							expectedStmt: "INSERT INTO projections.system_features3 (key, creation_date, change_date, sequence, value) VALUES ($1, $2, $3, $4, $5) ON CONFLICT (key) DO UPDATE SET (creation_date, change_date, sequence, value) = (projections.system_features3.creation_date, EXCLUDED.change_date, EXCLUDED.sequence, EXCLUDED.value)",
+							expectedStmt: "INSERT INTO projections.system_features4 (key, creation_date, change_date, sequence, value) VALUES ($1, $2, $3, $4, $5) ON CONFLICT (key) DO UPDATE SET (creation_date, change_date, sequence, value) = (projections.system_features4.creation_date, EXCLUDED.change_date, EXCLUDED.sequence, EXCLUDED.value)",
 							expectedArgs: []interface{}{
 								"user_schema",
 								anyArg{},
@@ -66,7 +66,7 @@ func TestSystemFeaturesProjection_reduces(t *testing.T) {
 				executer: &testExecuter{
 					executions: []execution{
 						{
-							expectedStmt: "DELETE FROM projections.system_features3 WHERE (key IS NOT NULL)",
+							expectedStmt: "DELETE FROM projections.system_features4 WHERE (key IS NOT NULL)",
 							expectedArgs: []interface{}{},
 						},
 					},

internal/query/system_features.go

@@ -24,7 +24,6 @@ type SystemFeatures struct {
 	UserSchema                     FeatureSource[bool]
 	ImprovedPerformance            FeatureSource[[]feature.ImprovedPerformanceType]
 	OIDCSingleV1SessionTermination FeatureSource[bool]
-	EnableBackChannelLogout        FeatureSource[bool]
 	LoginV2                        FeatureSource[*feature.LoginV2]
 	PermissionCheckV2              FeatureSource[bool]
 	EnableRelationalTables         FeatureSource[bool]

internal/query/system_features_model.go

@@ -59,7 +59,6 @@ func (m *SystemFeaturesReadModel) Query() *eventstore.SearchQueryBuilder {
 			feature_v2.SystemUserSchemaEventType,
 			feature_v2.SystemImprovedPerformanceEventType,
 			feature_v2.SystemOIDCSingleV1SessionTerminationEventType,
-			feature_v2.SystemEnableBackChannelLogout,
 			feature_v2.SystemLoginVersion,
 			feature_v2.SystemPermissionCheckV2,
 			feature_v2.SystemEnableRelationalTables,
@@ -88,8 +87,6 @@ func reduceSystemFeatureSet[T any](features *SystemFeatures, event *feature_v2.S
 		features.ImprovedPerformance.set(level, event.Value)
 	case feature.KeyOIDCSingleV1SessionTermination:
 		features.OIDCSingleV1SessionTermination.set(level, event.Value)
-	case feature.KeyEnableBackChannelLogout:
-		features.EnableBackChannelLogout.set(level, event.Value)
 	case feature.KeyLoginV2:
 		features.LoginV2.set(level, event.Value)
 	case feature.KeyPermissionCheckV2:

internal/repository/feature/feature_v2/eventstore.go

@@ -11,7 +11,6 @@ func init() {
 	eventstore.RegisterFilterEventMapper(AggregateType, SystemUserSchemaEventType, eventstore.GenericEventMapper[SetEvent[bool]])
 	eventstore.RegisterFilterEventMapper(AggregateType, SystemImprovedPerformanceEventType, eventstore.GenericEventMapper[SetEvent[[]feature.ImprovedPerformanceType]])
 	eventstore.RegisterFilterEventMapper(AggregateType, SystemOIDCSingleV1SessionTerminationEventType, eventstore.GenericEventMapper[SetEvent[bool]])
-	eventstore.RegisterFilterEventMapper(AggregateType, SystemEnableBackChannelLogout, eventstore.GenericEventMapper[SetEvent[bool]])
 	eventstore.RegisterFilterEventMapper(AggregateType, SystemLoginVersion, eventstore.GenericEventMapper[SetEvent[*feature.LoginV2]])
 	eventstore.RegisterFilterEventMapper(AggregateType, SystemPermissionCheckV2, eventstore.GenericEventMapper[SetEvent[bool]])
 	eventstore.RegisterFilterEventMapper(AggregateType, SystemEnableRelationalTables, eventstore.GenericEventMapper[SetEvent[bool]])
@@ -22,7 +21,6 @@ func init() {
 	eventstore.RegisterFilterEventMapper(AggregateType, InstanceImprovedPerformanceEventType, eventstore.GenericEventMapper[SetEvent[[]feature.ImprovedPerformanceType]])
 	eventstore.RegisterFilterEventMapper(AggregateType, InstanceDebugOIDCParentErrorEventType, eventstore.GenericEventMapper[SetEvent[bool]])
 	eventstore.RegisterFilterEventMapper(AggregateType, InstanceOIDCSingleV1SessionTerminationEventType, eventstore.GenericEventMapper[SetEvent[bool]])
-	eventstore.RegisterFilterEventMapper(AggregateType, InstanceEnableBackChannelLogout, eventstore.GenericEventMapper[SetEvent[bool]])
 	eventstore.RegisterFilterEventMapper(AggregateType, InstanceLoginVersion, eventstore.GenericEventMapper[SetEvent[*feature.LoginV2]])
 	eventstore.RegisterFilterEventMapper(AggregateType, InstancePermissionCheckV2, eventstore.GenericEventMapper[SetEvent[bool]])
 	eventstore.RegisterFilterEventMapper(AggregateType, InstanceManagementConsoleUseV2UserApi, eventstore.GenericEventMapper[SetEvent[bool]])

internal/repository/feature/feature_v2/feature.go

@@ -16,7 +16,6 @@ var (
 	SystemUserSchemaEventType                     = setEventTypeFromFeature(feature.LevelSystem, feature.KeyUserSchema)
 	SystemImprovedPerformanceEventType            = setEventTypeFromFeature(feature.LevelSystem, feature.KeyImprovedPerformance)
 	SystemOIDCSingleV1SessionTerminationEventType = setEventTypeFromFeature(feature.LevelSystem, feature.KeyOIDCSingleV1SessionTermination)
-	SystemEnableBackChannelLogout                 = setEventTypeFromFeature(feature.LevelSystem, feature.KeyEnableBackChannelLogout)
 	SystemLoginVersion                            = setEventTypeFromFeature(feature.LevelSystem, feature.KeyLoginV2)
 	SystemPermissionCheckV2                       = setEventTypeFromFeature(feature.LevelSystem, feature.KeyPermissionCheckV2)
 	SystemEnableRelationalTables                  = setEventTypeFromFeature(feature.LevelSystem, feature.KeyEnableRelationalTables)
@@ -27,7 +26,6 @@ var (
 	InstanceImprovedPerformanceEventType            = setEventTypeFromFeature(feature.LevelInstance, feature.KeyImprovedPerformance)
 	InstanceDebugOIDCParentErrorEventType           = setEventTypeFromFeature(feature.LevelInstance, feature.KeyDebugOIDCParentError)
 	InstanceOIDCSingleV1SessionTerminationEventType = setEventTypeFromFeature(feature.LevelInstance, feature.KeyOIDCSingleV1SessionTermination)
-	InstanceEnableBackChannelLogout                 = setEventTypeFromFeature(feature.LevelInstance, feature.KeyEnableBackChannelLogout)
 	InstanceLoginVersion                            = setEventTypeFromFeature(feature.LevelInstance, feature.KeyLoginV2)
 	InstancePermissionCheckV2                       = setEventTypeFromFeature(feature.LevelInstance, feature.KeyPermissionCheckV2)
 	InstanceManagementConsoleUseV2UserApi           = setEventTypeFromFeature(feature.LevelInstance, feature.KeyManagementConsoleUseV2UserApi)

proto/zitadel/feature/v2/instance.proto

@@ -61,11 +61,11 @@ message SetInstanceFeaturesRequest{
     }
   ];
 
+  // Deprecated: the flag has been removed and OIDC Back-Channel Logout is always enabled.
+  // This field is only kept for backward compatibility and will be removed in the next major version of Zitadel.
+  // Setting the field will have no effect.
   optional bool enable_back_channel_logout = 12 [
-    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
-      example: "true";
-      description: "If the flag is enabled, you'll be able to use the OIDC Back-Channel Logout to be notified in your application about terminated user sessions.";
-    }
+    deprecated = true
   ];
 
   optional LoginV2 login_v2 = 13 [
@@ -164,11 +164,10 @@ message GetInstanceFeaturesResponse {
     }
   ];
 
+  // Deprecated: the flag has been removed and OIDC Back-Channel Logout is always enabled.
+  // This field is only kept for backward compatibility and will be removed in the next major version of Zitadel.
   FeatureFlag enable_back_channel_logout = 13 [
-    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
-      example: "true";
-      description: "If the flag is enabled, you'll be able to use the OIDC Back-Channel Logout to be notified in your application about terminated user sessions.";
-    }
+    deprecated = true
   ];
 
   LoginV2FeatureFlag login_v2 = 14 [

proto/zitadel/feature/v2/system.proto

@@ -54,11 +54,11 @@ message SetSystemFeaturesRequest{
     }
   ];
 
+  // Deprecated: the flag has been removed and OIDC Back-Channel Logout is always enabled.
+  // This field is only kept for backward compatibility and will be removed in the next major version of Zitadel.
+  // Setting the field will have no effect.
   optional bool enable_back_channel_logout = 10 [
-    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
-      example: "true";
-      description: "If the flag is enabled, you'll be able to use the OIDC Back-Channel Logout to be notified in your application about terminated user sessions.";
-    }
+    deprecated = true
   ];
 
   optional LoginV2 login_v2 = 11 [
@@ -137,11 +137,10 @@ message GetSystemFeaturesResponse {
     }
   ];
 
+  // Deprecated: the flag has been removed and OIDC Back-Channel Logout is always enabled.
+  // This field is only kept for backward compatibility and will be removed in the next major version of Zitadel.
   FeatureFlag enable_back_channel_logout = 11 [
-    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
-      example: "true";
-      description: "If the flag is enabled, you'll be able to use the OIDC Back-Channel Logout to be notified in your application about terminated user sessions.";
-    }
+    deprecated = true
   ];
 
   LoginV2FeatureFlag login_v2 = 12 [