diff --git a/apps/docs/content/guides/integrate/back-channel-logout.mdx b/apps/docs/content/guides/integrate/back-channel-logout.mdx index 2430418bb..1773877af 100644 --- a/apps/docs/content/guides/integrate/back-channel-logout.mdx +++ b/apps/docs/content/guides/integrate/back-channel-logout.mdx @@ -7,12 +7,6 @@ The Back-Channel Logout implements [OpenID Connect Back-Channel Logout 1.0](http and can be used to notify applications about session termination at the OpenID Provider. This guide will explain how back-channel logout is implemented inside ZITADEL and gives some usage examples. - -Back-Channel Logout is currently an experimental [beta](https://help.zitadel.com/zitadel-software-release-cycle#beta) feature. -Be sure to enable it on the [feature API](#feature-api) before using it. -We highly recommend also enabling the `webkey` feature on your instance. This will prevent issues with automatic key rotation. - - In this guide we assume your already familiar with getting and validation token. You should already have a good understanding on the following topics before starting with this guide: @@ -51,7 +45,7 @@ The application can then invalidate the user's session without the need for an a As required by the [specification](https://openid.net/specs/openid-connect-backchannel-1_0.html#BCSupport), ZITADEL will advertise the `backchannel_logout_supported` and `backchannel_logout_session_supported` -on the discovery endpoint once the feature flag is enabled. +on the discovery endpoint by default. The latter boolean indicates, that ZITADEL will provide a session ID (`sid`) claim as part of the logout token. This provides the possibility to match the exact SSO session, which was terminated. @@ -85,7 +79,7 @@ The following Claims are used within the Logout Token: | Claim | Example | Description | |--------|----------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| -| iss | `${CUSTOM_DOMAIN}` | Issuer Identifier | +| iss | `${CUSTOM_DOMAIN}` | Issuer Identifier | | sub | `77776025198584418` | Subject Identifier (the user who signed out) | | aud | `69234237810729019` | Audience(s), will always contain your client_id | | iat | `1311280970` | Issued at time | diff --git a/cmd/defaults.yaml b/cmd/defaults.yaml index d89745e84..427062b67 100644 --- a/cmd/defaults.yaml +++ b/cmd/defaults.yaml @@ -1291,7 +1291,6 @@ DefaultInstance: # - 5 # OrgDomainVerified DebugOIDCParentError: # ZITADEL_DEFAULTINSTANCE_FEATURES_DEBUGOIDCPARENTERROR OIDCSingleV1SessionTermination: # ZITADEL_DEFAULTINSTANCE_FEATURES_OIDCSINGLEV1SESSIONTERMINATION - EnableBackChannelLogout: # ZITADEL_DEFAULTINSTANCE_FEATURES_ENABLEBACKCHANNELLOGOUT LoginV2: Required: true # ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED BaseURI: # ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_BASEURI diff --git a/console/src/app/components/features/features.component.ts b/console/src/app/components/features/features.component.ts index 2e2aa45ed..19644fd14 100644 --- a/console/src/app/components/features/features.component.ts +++ b/console/src/app/components/features/features.component.ts @@ -29,7 +29,6 @@ import { LoginV2FeatureToggleComponent } from '../feature-toggle/login-v2-featur const FEATURE_KEYS = [ 'consoleUseV2UserApi', 'debugOidcParentError', - 'enableBackChannelLogout', // 'improvedPerformance', 'loginDefaultOrg', 'oidcSingleV1SessionTermination', diff --git a/console/src/assets/i18n/ar.json b/console/src/assets/i18n/ar.json index 9fcde008b..aad94dab1 100644 --- a/console/src/assets/i18n/ar.json +++ b/console/src/assets/i18n/ar.json @@ -1638,8 +1638,6 @@ "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "إذا تم تمكين العلامة، فستتمكن من إنهاء جلسة واحدة من واجهة تسجيل الدخول من خلال توفير id_token مع مطالبة `sid` كـ id_token_hint في نقطة نهاية end_session. لاحظ أنه حالياً يتم إنهاء جميع الجلسات من نفس وكيل المستخدم (المتصفح) في واجهة تسجيل الدخول. الجلسات التي تدار من خلال Session API تسمح بالفعل بإنهاء جلسات فردية.", "DEBUGOIDCPARENTERROR": "تصحيح خطأ OIDC Parent", "DEBUGOIDCPARENTERROR_DESCRIPTION": "إذا تم تمكين العلامة، سيتم تسجيل خطأ OIDC parent في وحدة التحكم.", - "ENABLEBACKCHANNELLOGOUT": "تمكين تسجيل الخروج عبر القناة الخلفية (Backchannel Logout)", - "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "ينفذ تسجيل الخروج عبر القناة الخلفية OpenID Connect Back-Channel Logout 1.0 ويمكن استخدامه لإخطار التطبيقات بإنهاء الجلسة في مزود OpenID.", "PERMISSIONCHECKV2": "فحص الأذونات V2", "PERMISSIONCHECKV2_DESCRIPTION": "إذا تم تمكين العلامة، فستتمكن من استخدام API الجديد وميزاته.", "STATES": { diff --git a/console/src/assets/i18n/bg.json b/console/src/assets/i18n/bg.json index 0406dd8bc..231238e64 100644 --- a/console/src/assets/i18n/bg.json +++ b/console/src/assets/i18n/bg.json @@ -1645,8 +1645,6 @@ "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "Ако флагът е активиран, ще можете да прекратите единична сесия от UI за вход, като предоставите id_token с `sid` претенция като id_token_hint на крайната точка на end_session. Имайте предвид, че в момента всички сесии от същия потребителски агент (браузър) се прекратяват в UI за вход. Сесиите, управлявани чрез API на сесията, вече позволяват прекратяването на единични сесии.", "DEBUGOIDCPARENTERROR": "Отстраняване на грешки на OIDC родителя", "DEBUGOIDCPARENTERROR_DESCRIPTION": "Ако флагът е активиран, грешката на OIDC родителя ще бъде записана в конзолата.", - "ENABLEBACKCHANNELLOGOUT": "Активиране на Backchannel Logout", - "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "Back-Channel Logout имплементира OpenID Connect Back-Channel Logout 1.0 и може да се използва за уведомяване на приложенията за прекратяване на сесията при OpenID доставчика.", "PERMISSIONCHECKV2": "Проверка на разрешения V2", "PERMISSIONCHECKV2_DESCRIPTION": "Ако флагът е активиран, ще можете да използвате новия API и неговите функции.", "STATES": { diff --git a/console/src/assets/i18n/cs.json b/console/src/assets/i18n/cs.json index 486e85332..fcd7b91c7 100644 --- a/console/src/assets/i18n/cs.json +++ b/console/src/assets/i18n/cs.json @@ -1643,8 +1643,6 @@ "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "Pokud je příznak aktivován, budete moci ukončit jedinou relaci z rozhraní pro přihlášení zadáním id_token s nárokem `sid` jako id_token_hint na koncovém bodu end_session. Poznamenejte si, že v současné době jsou v rozhraní pro přihlášení ukončeny všechny relace ze stejného uživatelského agenta (prohlížeče). Relace spravované prostřednictvím rozhraní API relace již umožňují ukončení jednotlivých relací.", "DEBUGOIDCPARENTERROR": "Debugování chyby rodiče OIDC", "DEBUGOIDCPARENTERROR_DESCRIPTION": "Pokud je příznak povolen, chyba rodiče OIDC bude zaznamenána v konzoli.", - "ENABLEBACKCHANNELLOGOUT": "Povolit Backchannel Logout", - "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "Back-Channel Logout implementuje OpenID Connect Back-Channel Logout 1.0 a může být použit k informování aplikací o ukončení relace u poskytovatele OpenID.", "PERMISSIONCHECKV2": "Kontrola oprávnění V2", "PERMISSIONCHECKV2_DESCRIPTION": "Pokud je příznak povolen, budete moci používat nový API a jeho funkce.", "STATES": { diff --git a/console/src/assets/i18n/de.json b/console/src/assets/i18n/de.json index 1a54bdbbc..7de591f20 100644 --- a/console/src/assets/i18n/de.json +++ b/console/src/assets/i18n/de.json @@ -1643,8 +1643,6 @@ "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "Wenn das Flag aktiviert ist, können Sie eine einzelne Sitzung über die Login-Benutzeroberfläche beenden, indem Sie einen id_token mit einem `sid` Claim als id_token_hint am Endpunkt end_session übergeben. Beachten Sie, dass derzeit alle Sitzungen desselben Benutzeragenten (Browser) in der Login-Benutzeroberfläche beendet werden. Sitzungen, die über die Session API verwaltet werden, ermöglichen bereits die Beendigung einzelner Sitzungen.", "DEBUGOIDCPARENTERROR": "Debug OIDC Parent error", "DEBUGOIDCPARENTERROR_DESCRIPTION": "Wenn die Flagge aktiviert ist, wird der OIDC-Elternfehler in der Konsole protokolliert.", - "ENABLEBACKCHANNELLOGOUT": "Backchannel-Logout aktivieren", - "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "Der Back-Channel-Logout implementiert OpenID Connect Back-Channel Logout 1.0 und kann verwendet werden, um Anwendungen über die Beendigung der Sitzung beim OpenID-Provider zu benachrichtigen.", "PERMISSIONCHECKV2": "Berechtigungsprüfung V2", "PERMISSIONCHECKV2_DESCRIPTION": "Wenn die Flagge aktiviert ist, können Sie die neue API und ihre Funktionen verwenden.", "STATES": { diff --git a/console/src/assets/i18n/en.json b/console/src/assets/i18n/en.json index 28ae9176f..fb276ddb5 100644 --- a/console/src/assets/i18n/en.json +++ b/console/src/assets/i18n/en.json @@ -1647,8 +1647,6 @@ "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "If the flag is enabled, you'll be able to terminate a single session from the login UI by providing an id_token with a `sid` claim as id_token_hint on the end_session endpoint. Note that currently all sessions from the same user agent (browser) are terminated in the login UI. Sessions managed through the Session API already allow the termination of single sessions.", "DEBUGOIDCPARENTERROR": "Debug OIDC Parent Error", "DEBUGOIDCPARENTERROR_DESCRIPTION": "If the flag is enabled, the OIDC parent error will be logged in the console.", - "ENABLEBACKCHANNELLOGOUT": "Enable Backchannel Logout", - "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "The Back-Channel Logout implements OpenID Connect Back-Channel Logout 1.0 and can be used to notify applications about session termination at the OpenID Provider.", "PERMISSIONCHECKV2": "Permission Check V2", "PERMISSIONCHECKV2_DESCRIPTION": "If the flag is enabled, you'll be able to use the new API and its features.", "STATES": { diff --git a/console/src/assets/i18n/es.json b/console/src/assets/i18n/es.json index d3b25b258..5c6cea5b6 100644 --- a/console/src/assets/i18n/es.json +++ b/console/src/assets/i18n/es.json @@ -1644,8 +1644,6 @@ "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "Si la bandera está habilitada, podrá terminar una sesión única desde la interfaz de usuario de inicio de sesión proporcionando un id_token con una reclamación `sid` como id_token_hint en el punto final de end_session. Tenga en cuenta que actualmente se terminan todas las sesiones del mismo agente de usuario (navegador) en la interfaz de usuario de inicio de sesión. Las sesiones administradas a través de la API de sesión ya permiten la terminación de sesiones individuales.", "DEBUGOIDCPARENTERROR": "Debug OIDC Parent Error", "DEBUGOIDCPARENTERROR_DESCRIPTION": "Si la bandera está habilitada, el error del padre OIDC se registrará en la consola.", - "ENABLEBACKCHANNELLOGOUT": "Habilitar Backchannel Logout", - "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "El Back-Channel Logout implementa OpenID Connect Back-Channel Logout 1.0 y se puede usar para notificar a las aplicaciones sobre la terminación de la sesión en el proveedor de OpenID.", "PERMISSIONCHECKV2": "Verificación de permisos V2", "PERMISSIONCHECKV2_DESCRIPTION": "Si la bandera está habilitada, podrá usar la nueva API y sus funciones.", "STATES": { diff --git a/console/src/assets/i18n/fr.json b/console/src/assets/i18n/fr.json index d82cb5883..acba335c1 100644 --- a/console/src/assets/i18n/fr.json +++ b/console/src/assets/i18n/fr.json @@ -1643,8 +1643,6 @@ "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "Si l'indicateur est activé, vous pourrez terminer une seule session à partir de l'interface utilisateur de connexion en fournissant un id_token avec une revendication `sid` en tant que id_token_hint sur le point de terminaison end_session. Notez que toutes les sessions du même agent utilisateur (navigateur) sont actuellement terminées dans l'interface utilisateur de connexion. Les sessions gérées via l'API de session permettent déjà la terminaison de sessions individuelles.", "DEBUGOIDCPARENTERROR": "Debug OIDC Parent Error", "DEBUGOIDCPARENTERROR_DESCRIPTION": "Si le drapeau est activé, l'erreur parent OIDC sera enregistrée dans la console.", - "ENABLEBACKCHANNELLOGOUT": "Activer le Backchannel Logout", - "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "Le Back-Channel Logout implémente OpenID Connect Back-Channel Logout 1.0 et peut être utilisé pour notifier les applications de la fin de session chez le fournisseur OpenID.", "PERMISSIONCHECKV2": "Vérification des permissions V2", "PERMISSIONCHECKV2_DESCRIPTION": "Si le drapeau est activé, vous pourrez utiliser la nouvelle API et ses fonctionnalités.", "STATES": { diff --git a/console/src/assets/i18n/hu.json b/console/src/assets/i18n/hu.json index a4d549eef..04767c1fe 100644 --- a/console/src/assets/i18n/hu.json +++ b/console/src/assets/i18n/hu.json @@ -1641,8 +1641,6 @@ "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "Ha a zászló engedélyezve van, képes leszel egyetlen munkamenetet megszüntetni a bejelentkezési UI-ben, ha egy id_tokent biztosítasz egy `sid` claim-mel mint id_token_hint az end_session végpontnál. Megjegyzendő, hogy jelenleg az összes munkamenet ugyanabból a felhasználói ügynökből (böngésző) leállításra kerül a bejelentkezési UI-ben. A Session API-val kezelt munkamenetek már lehetővé teszik egyes munkamenetek megszüntetését.", "DEBUGOIDCPARENTERROR": "Debug OIDC Parent Error", "DEBUGOIDCPARENTERROR_DESCRIPTION": "Ha a zászló engedélyezve van, az OIDC szülő hiba naplózva lesz a konzolban.", - "ENABLEBACKCHANNELLOGOUT": "Backchannel Logout engedélyezése", - "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "A Back-Channel Logout megvalósítja az OpenID Connect Back-Channel Logout 1.0-t, és használható az alkalmazások értesítésére a munkamenet befejezéséről az OpenID szolgáltatónál.", "PERMISSIONCHECKV2": "Engedély ellenőrzés V2", "PERMISSIONCHECKV2_DESCRIPTION": "Ha a zászló engedélyezve van, használhatja az új API-t és annak funkcióit.", "STATES": { diff --git a/console/src/assets/i18n/id.json b/console/src/assets/i18n/id.json index a80960532..da9954716 100644 --- a/console/src/assets/i18n/id.json +++ b/console/src/assets/i18n/id.json @@ -1640,8 +1640,6 @@ "ACTIONS": "Tindakan", "ACTIONS_DESCRIPTION": "Tindakan v2 memungkinkan untuk mengelola eksekusi dan target data. Jika tanda ini diaktifkan, Anda akan dapat menggunakan API baru dan fitur-fiturnya.", "DEBUGOIDCPARENTERROR_DESCRIPTION": "If the flag is enabled, the OIDC parent error will be logged in the console.", - "ENABLEBACKCHANNELLOGOUT": "Enable Backchannel Logout", - "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "The Back-Channel Logout implements OpenID Connect Back-Channel Logout 1.0 and can be used to notify applications about session termination at the OpenID Provider.", "PERMISSIONCHECKV2": "Permission Check V2", "PERMISSIONCHECKV2_DESCRIPTION": "If the flag is enabled, you'll be able to use the new API and its features.", "STATES": { diff --git a/console/src/assets/i18n/it.json b/console/src/assets/i18n/it.json index 3e4d9843a..536de13e3 100644 --- a/console/src/assets/i18n/it.json +++ b/console/src/assets/i18n/it.json @@ -1643,8 +1643,6 @@ "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "Se il flag è abilitato, sarai in grado di terminare una singola sessione dall'interfaccia utente di accesso fornendo un id_token con una richiesta `sid` come id_token_hint nel punto finale di end_session. Tieni presente che attualmente tutte le sessioni dello stesso agente utente (browser) vengono terminate nell'interfaccia utente di accesso. Le sessioni gestite tramite l'API di sessione consentono già la terminazione di singole sessioni.", "DEBUGOIDCPARENTERROR": "Debug OIDC Parent Error", "DEBUGOIDCPARENTERROR_DESCRIPTION": "Se il flag è abilitato, l'errore OIDC originante verrà registrato nella console.", - "ENABLEBACKCHANNELLOGOUT": "Abilita Backchannel Logout", - "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "Il Back-Channel Logout implementa OpenID Connect Back-Channel Logout 1.0 e può essere utilizzato per notificare alle applicazioni la terminazione della sessione presso il provider OpenID.", "PERMISSIONCHECKV2": "Controllo permessi V2", "PERMISSIONCHECKV2_DESCRIPTION": "Se il flag è abilitato, potrai utilizzare la nuova API e le sue funzionalità.", "STATES": { diff --git a/console/src/assets/i18n/ja.json b/console/src/assets/i18n/ja.json index 715e7cc66..22d22355e 100644 --- a/console/src/assets/i18n/ja.json +++ b/console/src/assets/i18n/ja.json @@ -1643,8 +1643,6 @@ "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "フラグが有効になっている場合、id_token を `sid` クレームと共に id_token_hint として end_session エンドポイントに提供することで、ログイン UI から単一のセッションを終了できるようになります。 現在、同じユーザー エージェント (ブラウザ) からのすべてのセッションがログイン UI で終了することに注意してください。 セッション API を通じて管理されるセッションは、すでに単一のセッションの終了を許可しています。", "DEBUGOIDCPARENTERROR": "デバッグ OIDC 親エラー", "DEBUGOIDCPARENTERROR_DESCRIPTION": "フラグが有効になっている場合、OIDC 親エラーはコンソールに記録されます。", - "ENABLEBACKCHANNELLOGOUT": "バックチャネルログアウトを有効にする", - "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "バックチャネルログアウトは OpenID Connect バックチャネルログアウト 1.0 を実装し、OpenID プロバイダーでのセッション終了についてアプリケーションに通知するために使用できます。", "PERMISSIONCHECKV2": "権限チェック V2", "PERMISSIONCHECKV2_DESCRIPTION": "フラグが有効になっている場合、新しい API とその機能を使用できます。", "STATES": { diff --git a/console/src/assets/i18n/ko.json b/console/src/assets/i18n/ko.json index 2fa0eb26e..5701a8cd1 100644 --- a/console/src/assets/i18n/ko.json +++ b/console/src/assets/i18n/ko.json @@ -1643,8 +1643,6 @@ "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "플래그가 활성화되면, `sid` 클레임이 있는 id_token을 사용하여 end_session 엔드포인트에서 로그인 UI의 단일 세션을 종료할 수 있습니다. 현재 동일한 사용자 에이전트(브라우저)에서 모든 세션이 로그인 UI에서 종료됩니다. Session API를 통해 관리된 세션은 이미 단일 세션 종료를 허용합니다.", "DEBUGOIDCPARENTERROR": "디버그 OIDC 부모 오류", "DEBUGOIDCPARENTERROR_DESCRIPTION": "플래그가 활성화되면 OIDC 부모 오류가 콘솔에 기록됩니다.", - "ENABLEBACKCHANNELLOGOUT": "백채널 로그아웃 활성화", - "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "백채널 로그아웃은 OpenID Connect 백채널 로그아웃 1.0을 구현하며, OpenID 제공자에서 세션 종료에 대해 애플리케이션에게 알리는 데 사용할 수 있습니다.", "PERMISSIONCHECKV2": "권한 확인 V2", "PERMISSIONCHECKV2_DESCRIPTION": "플래그가 활성화되면 새로운 API와 그 기능을 사용할 수 있습니다.", "STATES": { diff --git a/console/src/assets/i18n/mk.json b/console/src/assets/i18n/mk.json index 058d66ed3..f4211deb2 100644 --- a/console/src/assets/i18n/mk.json +++ b/console/src/assets/i18n/mk.json @@ -1644,8 +1644,6 @@ "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "Ако ознаката е активирана, ќе можете да ја завршите единечна сесија од корисничкиот интерфејс за најава, со обезбедување id_token со `sid` побарување како id_token_hint на крајната точка на end_session. Имајте предвид дека во моментов сите сесии од истиот кориснички агент (прелистувач) се завршуваат во корисничкиот интерфејс за најава. Сесиите управувани преку API на сесија веќе дозволуваат завршување на единечни сесии.", "DEBUGOIDCPARENTERROR": "Дебагирање на OIDC родителска грешка", "DEBUGOIDCPARENTERROR_DESCRIPTION": "Ако знамето е овозможено, грешката на OIDC родителот ќе биде регистрирана во конзолата.", - "ENABLEBACKCHANNELLOGOUT": "Овозможи Backchannel Logout", - "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "Back-Channel Logout имплементира OpenID Connect Back-Channel Logout 1.0 и може да се користи за известување на апликациите за завршување на сесијата кај OpenID провајдерот.", "PERMISSIONCHECKV2": "Проверка на дозволи V2", "PERMISSIONCHECKV2_DESCRIPTION": "Ако знамето е овозможено, ќе можете да ја користите новата API и нејзините функции.", "STATES": { diff --git a/console/src/assets/i18n/nl.json b/console/src/assets/i18n/nl.json index e9540fcdd..c1430a9bf 100644 --- a/console/src/assets/i18n/nl.json +++ b/console/src/assets/i18n/nl.json @@ -1643,8 +1643,6 @@ "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "Als het vlagje is ingeschakeld, kunt u een enkele sessie beëindigen via de login-gebruikersinterface door een id_token met een `sid`-claim als id_token_hint op het eindpunt end_session te verstrekken. Houd er rekening mee dat momenteel alle sessies van dezelfde gebruikersagent (browser) worden beëindigd in de login-gebruikersinterface. Sessies die worden beheerd via de Session API staan al toe om individuele sessies te beëindigen.", "DEBUGOIDCPARENTERROR": "Debug OIDC Ouderfout", "DEBUGOIDCPARENTERROR_DESCRIPTION": "Als de vlag is ingeschakeld, wordt de OIDC-ouderfout in de console geregistreerd.", - "ENABLEBACKCHANNELLOGOUT": "Backchannel Logout inschakelen", - "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "De Back-Channel Logout implementeert OpenID Connect Back-Channel Logout 1.0 en kan worden gebruikt om applicaties te informeren over het beëindigen van de sessie bij de OpenID-provider.", "PERMISSIONCHECKV2": "Permissiecontrole V2", "PERMISSIONCHECKV2_DESCRIPTION": "Als de vlag is ingeschakeld, kunt u de nieuwe API en de bijbehorende functies gebruiken.", "STATES": { diff --git a/console/src/assets/i18n/pl.json b/console/src/assets/i18n/pl.json index 3af88e7bc..7bf28e784 100644 --- a/console/src/assets/i18n/pl.json +++ b/console/src/assets/i18n/pl.json @@ -1642,8 +1642,6 @@ "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "Jeśli flaga jest włączona, będziesz mógł zakończyć pojedynczą sesję z interfejsu użytkownika logowania, podając id_token z roszczeniem `sid` jako id_token_hint w punkcie końcowym end_session. Należy pamiętać, że obecnie wszystkie sesje z tego samego agenta użytkownika (przeglądarki) są kończone w interfejsie użytkownika logowania. Sesje zarządzane za pomocą interfejsu API sesji już pozwalają na zakończenie pojedynczych sesji.", "DEBUGOIDCPARENTERROR": "Debug OIDC Błąd nadrzędny", "DEBUGOIDCPARENTERROR_DESCRIPTION": "Jeśli flaga jest włączona, błąd nadrzędny OIDC zostanie zarejestrowany w konsoli.", - "ENABLEBACKCHANNELLOGOUT": "Włącz Backchannel Logout", - "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "Back-Channel Logout implementuje OpenID Connect Back-Channel Logout 1.0 i może być używany do powiadamiania aplikacji o zakończeniu sesji u dostawcy OpenID.", "PERMISSIONCHECKV2": "Sprawdzanie uprawnień V2", "PERMISSIONCHECKV2_DESCRIPTION": "Jeśli flaga jest włączona, będziesz mógł korzystać z nowego API i jego funkcji.", "STATES": { diff --git a/console/src/assets/i18n/pt.json b/console/src/assets/i18n/pt.json index b442a1ba2..72196f94f 100644 --- a/console/src/assets/i18n/pt.json +++ b/console/src/assets/i18n/pt.json @@ -1644,8 +1644,6 @@ "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "Se a bandeira estiver habilitada, você poderá encerrar uma sessão única da interface do usuário de login fornecendo um id_token com uma reivindicação `sid como id_token_hint no ponto final de end_session. Observe que atualmente todas as sessões do mesmo agente de usuário (navegador) são encerradas na interface do usuário de login. As sessões gerenciadas por meio da API de sessão já permitem o encerramento de sessões individuais.", "DEBUGOIDCPARENTERROR": "Erro de Depuração do Pai OIDC", "DEBUGOIDCPARENTERROR_DESCRIPTION": "Se a bandeira estiver ativada, o erro do pai OIDC será registrado no console.", - "ENABLEBACKCHANNELLOGOUT": "Ativar Logout de Backchannel", - "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "O Logout de Back-Channel implementa o OpenID Connect Back-Channel Logout 1.0 e pode ser usado para notificar os aplicativos sobre a terminação da sessão no Provedor de OpenID.", "PERMISSIONCHECKV2": "Verificação de Permissão V2", "PERMISSIONCHECKV2_DESCRIPTION": "Se a bandeira estiver ativada, você poderá usar a nova API e seus recursos.", "STATES": { diff --git a/console/src/assets/i18n/ro.json b/console/src/assets/i18n/ro.json index 65dee13a9..5f50b9dfa 100644 --- a/console/src/assets/i18n/ro.json +++ b/console/src/assets/i18n/ro.json @@ -1641,8 +1641,6 @@ "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "Dacă indicatorul este activat, veți putea termina o singură sesiune din UI-ul de conectare furnizând un id_token cu o revendicare sid ca id_token_hint pe endpointul end_session. Rețineți că în prezent toate sesiunile de la același agent utilizator (browser) sunt terminate în UI-ul de conectare. Sesiunile gestionate prin API-ul Session permit deja terminarea sesiunilor individuale.", "DEBUGOIDCPARENTERROR": "Eroare de Depanare Părinte OIDC", "DEBUGOIDCPARENTERROR_DESCRIPTION": "Dacă steagul este activat, eroarea părinte OIDC va fi înregistrată în consolă.", - "ENABLEBACKCHANNELLOGOUT": "Activează Logout Backchannel", - "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "Logout-ul Back-Channel implementează OpenID Connect Back-Channel Logout 1.0 și poate fi folosit pentru a notifica aplicațiile despre terminarea sesiunii la Producătorul OpenID.", "PERMISSIONCHECKV2": "Verificare Permisiuni V2", "PERMISSIONCHECKV2_DESCRIPTION": "Dacă steagul este activat, veți putea folosi noua API și funcțiile sale.", "STATES": { diff --git a/console/src/assets/i18n/ru.json b/console/src/assets/i18n/ru.json index 26716c728..74c8a3389 100644 --- a/console/src/assets/i18n/ru.json +++ b/console/src/assets/i18n/ru.json @@ -1704,8 +1704,6 @@ "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "Если флаг включен, вы сможете завершить отдельный сеанс из интерфейса пользователя входа, предоставив id_token с претензией `sid` в качестве id_token_hint на конечной точке end_session. Обратите внимание, что в настоящее время все сеансы одного и того же пользовательского агента (браузера) завершаются в интерфейсе пользователя входа. Сеансы, управляемые через API сеанса, уже позволяют завершать отдельные сеансы.", "DEBUGOIDCPARENTERROR": "Отладка Ошибки Родителя OIDC", "DEBUGOIDCPARENTERROR_DESCRIPTION": "Если флаг включен, ошибка родителя OIDC будет записана в консоль.", - "ENABLEBACKCHANNELLOGOUT": "Включить Backchannel Logout", - "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "Back-Channel Logout реализует OpenID Connect Back-Channel Logout 1.0 и может использоваться для уведомления приложений о завершении сеанса у поставщика OpenID.", "PERMISSIONCHECKV2": "Проверка Разрешений V2", "PERMISSIONCHECKV2_DESCRIPTION": "Если флаг включен, вы сможете использовать новый API и его функции.", "STATES": { diff --git a/console/src/assets/i18n/sv.json b/console/src/assets/i18n/sv.json index 8ac458f44..23fc33dd8 100644 --- a/console/src/assets/i18n/sv.json +++ b/console/src/assets/i18n/sv.json @@ -1647,8 +1647,6 @@ "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "Om flaggan är aktiverad, kan du avsluta en enskild session från inloggningsgränssnittet genom att ange en id_token med ett `sid`-krav som id_token_hint på slutpunkten end_session. Observera att för närvarande alla sessioner från samma användaragent (webbläsare) avslutas i inloggningsgränssnittet. Sessioner som hanteras via Session API tillåter redan avslutning av enskilda sessioner.", "DEBUGOIDCPARENTERROR": "Debugga OIDC Föräldrafel", "DEBUGOIDCPARENTERROR_DESCRIPTION": "Om flaggan är aktiverad kommer OIDC-föräldrafel att loggas i konsolen.", - "ENABLEBACKCHANNELLOGOUT": "Aktivera Backchannel Logout", - "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "Back-Channel Logout implementerar OpenID Connect Back-Channel Logout 1.0 och kan användas för att meddela applikationer om sessionens avslutning hos OpenID-leverantören.", "PERMISSIONCHECKV2": "Behörighetskontroll V2", "PERMISSIONCHECKV2_DESCRIPTION": "Om flaggan är aktiverad kan du använda den nya API:n och dess funktioner.", "STATES": { diff --git a/console/src/assets/i18n/tr.json b/console/src/assets/i18n/tr.json index 08c52e6ea..8ab7f3062 100644 --- a/console/src/assets/i18n/tr.json +++ b/console/src/assets/i18n/tr.json @@ -1646,8 +1646,6 @@ "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "Bayrak etkinleştirilirse, end_session uç noktasında id_token_hint olarak `sid` iddiası olan bir id_token sağlayarak giriş UI'ından tek bir oturumu sonlandırabileceksiniz. Şu anda giriş UI'ında aynı kullanıcı aracısından (tarayıcı) tüm oturumların sonlandırıldığını unutmayın. Oturum API'si aracılığıyla yönetilen oturumlar zaten tek oturumların sonlandırılmasına izin veriyor.", "DEBUGOIDCPARENTERROR": "OIDC Üst Hatayı Hata Ayıkla", "DEBUGOIDCPARENTERROR_DESCRIPTION": "Bayrak etkinleştirilirse, OIDC üst hatası konsolda günlüğe kaydedilecektir.", - "ENABLEBACKCHANNELLOGOUT": "Arka Kanal Çıkışını Etkinleştir", - "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "Arka Kanal Çıkışı OpenID Connect Arka Kanal Çıkışı 1.0'ı uygular ve OpenID Sağlayıcısında oturum sonlandırma hakkında uygulamaları bilgilendirmek için kullanılabilir.", "PERMISSIONCHECKV2": "İzin Kontrolü V2", "PERMISSIONCHECKV2_DESCRIPTION": "Bayrak etkinleştirilirse, yeni API'yi ve özelliklerini kullanabileceksiniz.", "STATES": { diff --git a/console/src/assets/i18n/uk.json b/console/src/assets/i18n/uk.json index 458fffa2a..bcaf41d8f 100644 --- a/console/src/assets/i18n/uk.json +++ b/console/src/assets/i18n/uk.json @@ -1647,8 +1647,6 @@ "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "Якщо прапорець увімкнено, ви зможете завершити одиночну сесію з інтерфейсу входу, надавши id_token з претензією `sid` як id_token_hint на кінцевій точці end_session. Зверніть увагу, що наразі всі сесії з того ж агента користувача (браузера) завершуються в інтерфейсі входу. Сесії, керовані через Session API, вже дозволяють завершення одиночних сесій.", "DEBUGOIDCPARENTERROR": "Налагодження батьківської помилки OIDC", "DEBUGOIDCPARENTERROR_DESCRIPTION": "Якщо прапорець увімкнено, батьківська помилка OIDC буде записана в консоль.", - "ENABLEBACKCHANNELLOGOUT": "Увімкнути вихід через зворотний канал", - "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "Вихід через зворотний канал реалізує OpenID Connect Back-Channel Logout 1.0 і може використовуватися для сповіщення додатків про завершення сесії у провайдера OpenID.", "PERMISSIONCHECKV2": "Перевірка дозволів V2", "PERMISSIONCHECKV2_DESCRIPTION": "Якщо прапорець увімкнено, ви зможете використовувати новий API та його можливості.", "STATES": { diff --git a/console/src/assets/i18n/zh.json b/console/src/assets/i18n/zh.json index c45915f9d..2bd759e99 100644 --- a/console/src/assets/i18n/zh.json +++ b/console/src/assets/i18n/zh.json @@ -1646,8 +1646,6 @@ "OIDCSINGLEV1SESSIONTERMINATION_DESCRIPTION": "如果启用了标志，您可以通过在 end_session 端点上提供带有 `sid` 声明的 id_token 作为 id_token_hint 来从登录 UI 终止单个会话。 请注意，目前所有来自同一用户代理（浏览器）的会话都在登录 UI 中终止。 通过会话 API 管理的会话已经允许终止单个会话。", "DEBUGOIDCPARENTERROR": "调试 OIDC 父错误", "DEBUGOIDCPARENTERROR_DESCRIPTION": "如果启用该标志，OIDC 父错误将记录在控制台中。", - "ENABLEBACKCHANNELLOGOUT": "启用 Backchannel 注销", - "ENABLEBACKCHANNELLOGOUT_DESCRIPTION": "Back-Channel 注销实现了 OpenID Connect Back-Channel Logout 1.0，可用于通知应用程序在 OpenID 提供商处终止会话。", "PERMISSIONCHECKV2": "权限检查 V2", "PERMISSIONCHECKV2_DESCRIPTION": "如果启用该标志，您将能够使用新的 API 及其功能。", "STATES": { diff --git a/internal/api/grpc/feature/v2/converter.go b/internal/api/grpc/feature/v2/converter.go index a303d713f..1f616fac0 100644 --- a/internal/api/grpc/feature/v2/converter.go +++ b/internal/api/grpc/feature/v2/converter.go @@ -22,7 +22,6 @@ func systemFeaturesToCommand(req *feature_pb.SetSystemFeaturesRequest) (*command UserSchema: req.UserSchema, ImprovedPerformance: improvedPerformanceListToDomain(req.ImprovedPerformance), OIDCSingleV1SessionTermination: req.OidcSingleV1SessionTermination, - EnableBackChannelLogout: req.EnableBackChannelLogout, LoginV2: loginV2, PermissionCheckV2: req.PermissionCheckV2, EnableRelationalTables: req.EnableRelationalTables, @@ -40,10 +39,13 @@ func systemFeaturesToPb(f *query.SystemFeatures) *feature_pb.GetSystemFeaturesRe }, ImprovedPerformance: featureSourceToImprovedPerformanceFlagPb(&f.ImprovedPerformance), OidcSingleV1SessionTermination: featureSourceToFlagPb(&f.OIDCSingleV1SessionTermination), - EnableBackChannelLogout: featureSourceToFlagPb(&f.EnableBackChannelLogout), - LoginV2: loginV2ToLoginV2FlagPb(f.LoginV2), - PermissionCheckV2: featureSourceToFlagPb(&f.PermissionCheckV2), - EnableRelationalTables: featureSourceToFlagPb(&f.EnableRelationalTables), + EnableBackChannelLogout: &feature_pb.FeatureFlag{ // TODO: remove in next major version + Enabled: true, + Source: feature_pb.Source_SOURCE_SYSTEM, + }, + LoginV2: loginV2ToLoginV2FlagPb(f.LoginV2), + PermissionCheckV2: featureSourceToFlagPb(&f.PermissionCheckV2), + EnableRelationalTables: featureSourceToFlagPb(&f.EnableRelationalTables), } } @@ -58,7 +60,6 @@ func instanceFeaturesToCommand(req *feature_pb.SetInstanceFeaturesRequest) (*com ImprovedPerformance: improvedPerformanceListToDomain(req.ImprovedPerformance), DebugOIDCParentError: req.DebugOidcParentError, OIDCSingleV1SessionTermination: req.OidcSingleV1SessionTermination, - EnableBackChannelLogout: req.EnableBackChannelLogout, LoginV2: loginV2, PermissionCheckV2: req.PermissionCheckV2, ManagementConsoleUseV2UserApi: req.ConsoleUseV2UserApi, @@ -78,11 +79,14 @@ func instanceFeaturesToPb(f *query.InstanceFeatures) *feature_pb.GetInstanceFeat ImprovedPerformance: featureSourceToImprovedPerformanceFlagPb(&f.ImprovedPerformance), DebugOidcParentError: featureSourceToFlagPb(&f.DebugOIDCParentError), OidcSingleV1SessionTermination: featureSourceToFlagPb(&f.OIDCSingleV1SessionTermination), - EnableBackChannelLogout: featureSourceToFlagPb(&f.EnableBackChannelLogout), - LoginV2: loginV2ToLoginV2FlagPb(f.LoginV2), - PermissionCheckV2: featureSourceToFlagPb(&f.PermissionCheckV2), - ConsoleUseV2UserApi: featureSourceToFlagPb(&f.ManagementConsoleUseV2UserApi), - EnableRelationalTables: featureSourceToFlagPb(&f.EnableRelationalTables), + EnableBackChannelLogout: &feature_pb.FeatureFlag{ // TODO: remove in next major version + Enabled: true, + Source: feature_pb.Source_SOURCE_SYSTEM, + }, + LoginV2: loginV2ToLoginV2FlagPb(f.LoginV2), + PermissionCheckV2: featureSourceToFlagPb(&f.PermissionCheckV2), + ConsoleUseV2UserApi: featureSourceToFlagPb(&f.ManagementConsoleUseV2UserApi), + EnableRelationalTables: featureSourceToFlagPb(&f.EnableRelationalTables), } } diff --git a/internal/api/grpc/feature/v2/converter_test.go b/internal/api/grpc/feature/v2/converter_test.go index 393ad4db1..1945e79b0 100644 --- a/internal/api/grpc/feature/v2/converter_test.go +++ b/internal/api/grpc/feature/v2/converter_test.go @@ -29,9 +29,8 @@ func Test_systemFeaturesToCommand(t *testing.T) { Required: true, BaseUri: gu.Ptr("https://login.com"), }, - EnableRelationalTables: gu.Ptr(true), - EnableBackChannelLogout: gu.Ptr(true), - PermissionCheckV2: gu.Ptr(true), + EnableRelationalTables: gu.Ptr(true), + PermissionCheckV2: gu.Ptr(true), } want := &command.SystemFeatures{ LoginDefaultOrg: gu.Ptr(true), @@ -42,9 +41,8 @@ func Test_systemFeaturesToCommand(t *testing.T) { Required: true, BaseURI: &url.URL{Scheme: "https", Host: "login.com"}, }, - EnableRelationalTables: gu.Ptr(true), - EnableBackChannelLogout: gu.Ptr(true), - PermissionCheckV2: gu.Ptr(true), + EnableRelationalTables: gu.Ptr(true), + PermissionCheckV2: gu.Ptr(true), } // Test @@ -81,10 +79,6 @@ func Test_systemFeaturesToPb(t *testing.T) { Level: feature.LevelSystem, Value: true, }, - EnableBackChannelLogout: query.FeatureSource[bool]{ - Level: feature.LevelSystem, - Value: true, - }, LoginV2: query.FeatureSource[*feature.LoginV2]{ Level: feature.LevelSystem, Value: &feature.LoginV2{ @@ -162,7 +156,6 @@ func Test_instanceFeaturesToCommand(t *testing.T) { ImprovedPerformance: nil, DebugOidcParentError: gu.Ptr(true), OidcSingleV1SessionTermination: gu.Ptr(true), - EnableBackChannelLogout: gu.Ptr(true), LoginV2: &feature_pb.LoginV2{ Required: true, BaseUri: gu.Ptr("https://login.com"), @@ -177,7 +170,6 @@ func Test_instanceFeaturesToCommand(t *testing.T) { ImprovedPerformance: nil, DebugOIDCParentError: gu.Ptr(true), OIDCSingleV1SessionTermination: gu.Ptr(true), - EnableBackChannelLogout: gu.Ptr(true), LoginV2: &feature.LoginV2{ Required: true, BaseURI: &url.URL{Scheme: "https", Host: "login.com"}, @@ -220,10 +212,6 @@ func Test_instanceFeaturesToPb(t *testing.T) { Level: feature.LevelInstance, Value: true, }, - EnableBackChannelLogout: query.FeatureSource[bool]{ - Level: feature.LevelInstance, - Value: true, - }, LoginV2: query.FeatureSource[*feature.LoginV2]{ Level: feature.LevelInstance, Value: &feature.LoginV2{ @@ -276,7 +264,7 @@ func Test_instanceFeaturesToPb(t *testing.T) { }, EnableBackChannelLogout: &feature_pb.FeatureFlag{ Enabled: true, - Source: feature_pb.Source_SOURCE_INSTANCE, + Source: feature_pb.Source_SOURCE_SYSTEM, }, LoginV2: &feature_pb.LoginV2FeatureFlag{ Required: true, diff --git a/internal/api/oidc/server.go b/internal/api/oidc/server.go index 36d1a153d..08d5a5a1c 100644 --- a/internal/api/oidc/server.go +++ b/internal/api/oidc/server.go @@ -178,7 +178,6 @@ func (s *Server) EndSession(ctx context.Context, r *op.Request[oidc.EndSessionRe func (s *Server) createDiscoveryConfig(ctx context.Context, supportedUILocales oidc.Locales) *oidc.DiscoveryConfiguration { issuer := op.IssuerFromContext(ctx) - backChannelLogoutSupported := authz.GetInstance(ctx).Features().EnableBackChannelLogout return &oidc.DiscoveryConfiguration{ Issuer: issuer, @@ -211,8 +210,8 @@ func (s *Server) createDiscoveryConfig(ctx context.Context, supportedUILocales o CodeChallengeMethodsSupported: op.CodeChallengeMethods(s.Provider()), UILocalesSupported: supportedUILocales, RequestParameterSupported: s.Provider().RequestObjectSupported(), - BackChannelLogoutSupported: backChannelLogoutSupported, - BackChannelLogoutSessionSupported: backChannelLogoutSupported, + BackChannelLogoutSupported: true, + BackChannelLogoutSessionSupported: true, } } diff --git a/internal/api/oidc/server_test.go b/internal/api/oidc/server_test.go index 9bf22fd21..1e012e8e4 100644 --- a/internal/api/oidc/server_test.go +++ b/internal/api/oidc/server_test.go @@ -106,6 +106,8 @@ func TestServer_createDiscoveryConfig(t *testing.T) { RequireRequestURIRegistration: false, OPPolicyURI: "", OPTermsOfServiceURI: "", + BackChannelLogoutSupported: true, + BackChannelLogoutSessionSupported: true, }, }, } diff --git a/internal/command/device_auth_test.go b/internal/command/device_auth_test.go index e017c68d6..140148250 100644 --- a/internal/command/device_auth_test.go +++ b/internal/command/device_auth_test.go @@ -19,7 +19,6 @@ import ( "github.com/zitadel/zitadel/internal/crypto" "github.com/zitadel/zitadel/internal/domain" "github.com/zitadel/zitadel/internal/eventstore" - "github.com/zitadel/zitadel/internal/feature" "github.com/zitadel/zitadel/internal/id" "github.com/zitadel/zitadel/internal/id/mock" "github.com/zitadel/zitadel/internal/repository/deviceauth" @@ -1088,7 +1087,7 @@ func TestCommands_CreateOIDCSessionFromDeviceAuth(t *testing.T) { }, }, { - name: "approved with backChannelLogout (feature enabled), success", + name: "approved with backChannelLogout, success", fields: fields{ eventstore: expectEventstore( expectFilter( @@ -1167,9 +1166,7 @@ func TestCommands_CreateOIDCSessionFromDeviceAuth(t *testing.T) { keyAlgorithm: crypto.CreateMockEncryptionAlg(gomock.NewController(t)), }, args: args{ - authz.WithFeatures(ctx, feature.Features{ - EnableBackChannelLogout: true, - }), + ctx, "123", "backChannelLogoutURI", }, diff --git a/internal/command/instance.go b/internal/command/instance.go index ec7352557..350a9875c 100644 --- a/internal/command/instance.go +++ b/internal/command/instance.go @@ -136,7 +136,6 @@ type InstanceSetupFeatures struct { ImprovedPerformance []feature.ImprovedPerformanceType DebugOIDCParentError *bool OIDCSingleV1SessionTermination *bool - EnableBackChannelLogout *bool LoginV2 *InstanceSetupFeatureLoginV2 PermissionCheckV2 *bool ManagementConsoleUseV2UserApi *bool @@ -169,7 +168,6 @@ func (f *InstanceSetupFeatures) ToInstanceFeatures() (_ *InstanceFeatures, err e ImprovedPerformance: f.ImprovedPerformance, DebugOIDCParentError: f.DebugOIDCParentError, OIDCSingleV1SessionTermination: f.OIDCSingleV1SessionTermination, - EnableBackChannelLogout: f.EnableBackChannelLogout, LoginV2: loginV2, PermissionCheckV2: f.PermissionCheckV2, ManagementConsoleUseV2UserApi: f.ManagementConsoleUseV2UserApi, diff --git a/internal/command/instance_features.go b/internal/command/instance_features.go index 76cc6f4ab..3100c49b1 100644 --- a/internal/command/instance_features.go +++ b/internal/command/instance_features.go @@ -18,7 +18,6 @@ type InstanceFeatures struct { ImprovedPerformance []feature.ImprovedPerformanceType DebugOIDCParentError *bool OIDCSingleV1SessionTermination *bool - EnableBackChannelLogout *bool LoginV2 *feature.LoginV2 PermissionCheckV2 *bool ManagementConsoleUseV2UserApi *bool @@ -32,7 +31,6 @@ func (m *InstanceFeatures) isEmpty() bool { m.ImprovedPerformance == nil && m.DebugOIDCParentError == nil && m.OIDCSingleV1SessionTermination == nil && - m.EnableBackChannelLogout == nil && m.LoginV2 == nil && m.PermissionCheckV2 == nil && m.ManagementConsoleUseV2UserApi == nil && diff --git a/internal/command/instance_features_model.go b/internal/command/instance_features_model.go index 8890d194c..941edfdfa 100644 --- a/internal/command/instance_features_model.go +++ b/internal/command/instance_features_model.go @@ -71,7 +71,6 @@ func (m *InstanceFeaturesWriteModel) Query() *eventstore.SearchQueryBuilder { feature_v2.InstanceImprovedPerformanceEventType, feature_v2.InstanceDebugOIDCParentErrorEventType, feature_v2.InstanceOIDCSingleV1SessionTerminationEventType, - feature_v2.InstanceEnableBackChannelLogout, feature_v2.InstanceLoginVersion, feature_v2.InstancePermissionCheckV2, feature_v2.InstanceManagementConsoleUseV2UserApi, @@ -103,9 +102,6 @@ func reduceInstanceFeature(features *InstanceFeatures, key feature.Key, value an case feature.KeyOIDCSingleV1SessionTermination: v := value.(bool) features.OIDCSingleV1SessionTermination = &v - case feature.KeyEnableBackChannelLogout: - v := value.(bool) - features.EnableBackChannelLogout = &v case feature.KeyLoginV2: features.LoginV2 = value.(*feature.LoginV2) case feature.KeyPermissionCheckV2: @@ -128,7 +124,6 @@ func (wm *InstanceFeaturesWriteModel) setCommands(ctx context.Context, f *Instan cmds = appendFeatureSliceUpdate(ctx, cmds, aggregate, wm.ImprovedPerformance, f.ImprovedPerformance, feature_v2.InstanceImprovedPerformanceEventType) cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.DebugOIDCParentError, f.DebugOIDCParentError, feature_v2.InstanceDebugOIDCParentErrorEventType) cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.OIDCSingleV1SessionTermination, f.OIDCSingleV1SessionTermination, feature_v2.InstanceOIDCSingleV1SessionTerminationEventType) - cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.EnableBackChannelLogout, f.EnableBackChannelLogout, feature_v2.InstanceEnableBackChannelLogout) cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.LoginV2, f.LoginV2, feature_v2.InstanceLoginVersion) cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.PermissionCheckV2, f.PermissionCheckV2, feature_v2.InstancePermissionCheckV2) cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.ManagementConsoleUseV2UserApi, f.ManagementConsoleUseV2UserApi, feature_v2.InstanceManagementConsoleUseV2UserApi) diff --git a/internal/command/instance_features_model_test.go b/internal/command/instance_features_model_test.go index de4b41867..0901658f9 100644 --- a/internal/command/instance_features_model_test.go +++ b/internal/command/instance_features_model_test.go @@ -74,15 +74,6 @@ func Test_reduceInstanceFeature(t *testing.T) { }, expected: &InstanceFeatures{OIDCSingleV1SessionTermination: gu.Ptr(true)}, }, - { - name: "enable back channel logout", - args: args{ - features: &InstanceFeatures{}, - key: feature.KeyEnableBackChannelLogout, - value: true, - }, - expected: &InstanceFeatures{EnableBackChannelLogout: gu.Ptr(true)}, - }, { name: "login v2", args: args{ diff --git a/internal/command/instance_test.go b/internal/command/instance_test.go index 0230dc410..75a4f8b28 100644 --- a/internal/command/instance_test.go +++ b/internal/command/instance_test.go @@ -1779,7 +1779,6 @@ func TestInstanceSetupFeatures_ToInstanceFeatures(t *testing.T) { ImprovedPerformance []feature.ImprovedPerformanceType DebugOIDCParentError *bool OIDCSingleV1SessionTermination *bool - EnableBackChannelLogout *bool LoginV2 *InstanceSetupFeatureLoginV2 PermissionCheckV2 *bool ManagementConsoleUseV2UserApi *bool @@ -1808,7 +1807,6 @@ func TestInstanceSetupFeatures_ToInstanceFeatures(t *testing.T) { ImprovedPerformance: []feature.ImprovedPerformanceType{feature.ImprovedPerformanceTypeOrgDomainVerified}, DebugOIDCParentError: gu.Ptr(true), OIDCSingleV1SessionTermination: gu.Ptr(false), - EnableBackChannelLogout: gu.Ptr(true), PermissionCheckV2: gu.Ptr(true), ManagementConsoleUseV2UserApi: gu.Ptr(false), EnableRelationalTables: gu.Ptr(true), @@ -1819,7 +1817,6 @@ func TestInstanceSetupFeatures_ToInstanceFeatures(t *testing.T) { ImprovedPerformance: []feature.ImprovedPerformanceType{feature.ImprovedPerformanceTypeOrgDomainVerified}, DebugOIDCParentError: gu.Ptr(true), OIDCSingleV1SessionTermination: gu.Ptr(false), - EnableBackChannelLogout: gu.Ptr(true), LoginV2: nil, PermissionCheckV2: gu.Ptr(true), ManagementConsoleUseV2UserApi: gu.Ptr(false), @@ -1875,7 +1872,6 @@ func TestInstanceSetupFeatures_ToInstanceFeatures(t *testing.T) { ImprovedPerformance: tc.fields.ImprovedPerformance, DebugOIDCParentError: tc.fields.DebugOIDCParentError, OIDCSingleV1SessionTermination: tc.fields.OIDCSingleV1SessionTermination, - EnableBackChannelLogout: tc.fields.EnableBackChannelLogout, LoginV2: tc.fields.LoginV2, PermissionCheckV2: tc.fields.PermissionCheckV2, ManagementConsoleUseV2UserApi: tc.fields.ManagementConsoleUseV2UserApi, diff --git a/internal/command/oidc_session.go b/internal/command/oidc_session.go index 3fc93d6dd..ff0d53289 100644 --- a/internal/command/oidc_session.go +++ b/internal/command/oidc_session.go @@ -452,9 +452,6 @@ func (c *OIDCSessionEvents) RegisterLogout(ctx context.Context, sessionID, userI if sessionID == "" || backChannelLogoutURI == "" { return } - if !authz.GetFeatures(ctx).EnableBackChannelLogout { - return - } c.events = append(c.events, sessionlogout.NewBackChannelLogoutRegisteredEvent( ctx, diff --git a/internal/command/oidc_session_test.go b/internal/command/oidc_session_test.go index 91eaafc8b..f66c6dffa 100644 --- a/internal/command/oidc_session_test.go +++ b/internal/command/oidc_session_test.go @@ -18,7 +18,6 @@ import ( "github.com/zitadel/zitadel/internal/crypto" "github.com/zitadel/zitadel/internal/domain" "github.com/zitadel/zitadel/internal/eventstore" - "github.com/zitadel/zitadel/internal/feature" "github.com/zitadel/zitadel/internal/id" "github.com/zitadel/zitadel/internal/id/mock" "github.com/zitadel/zitadel/internal/repository/authrequest" @@ -554,9 +553,7 @@ func TestCommands_CreateOIDCSessionFromAuthRequest(t *testing.T) { }, args{ - ctx: authz.WithFeatures(authz.WithInstanceID(context.Background(), "instanceID"), feature.Features{ - EnableBackChannelLogout: true, - }), + ctx: authz.WithInstanceID(context.Background(), "instanceID"), authRequestID: "V2_authRequestID", complianceCheck: mockAuthRequestComplianceChecker(nil), needRefreshToken: true, @@ -1333,104 +1330,6 @@ func TestCommands_CreateOIDCSession(t *testing.T) { }, { name: "with backChannelLogoutURI and sessionID", - fields: fields{ - eventstore: expectEventstore( - expectFilter( - user.NewHumanAddedEvent( - context.Background(), - &user.NewAggregate("userID", "org1").Aggregate, - "username", - "firstname", - "lastname", - "nickname", - "displayname", - language.Afrikaans, - domain.GenderUnspecified, - "email", - false, - ), - ), - expectFilter(), // token lifetime - expectPush( - oidcsession.NewAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, - "userID", "org1", "sessionID", "clientID", []string{"audience"}, []string{"openid", "offline_access"}, - []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow, "nonce", &language.Afrikaans, - &domain.UserAgent{ - FingerprintID: gu.Ptr("fp1"), - IP: net.ParseIP("1.2.3.4"), - Description: gu.Ptr("firefox"), - Header: http.Header{"foo": []string{"bar"}}, - }, - ), - oidcsession.NewAccessTokenAddedEvent(context.Background(), - &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, - "at_accessTokenID", []string{"openid", "offline_access"}, time.Hour, domain.TokenReasonAuthRequest, - &domain.TokenActor{ - UserID: "user2", - Issuer: "foo.com", - }, - ), - ), - ), - idGenerator: mock.NewIDGeneratorExpectIDs(t, "oidcSessionID", "accessTokenID"), - defaultAccessTokenLifetime: time.Hour, - defaultRefreshTokenLifetime: 7 * 24 * time.Hour, - defaultRefreshTokenIdleLifetime: 24 * time.Hour, - keyAlgorithm: crypto.CreateMockEncryptionAlg(gomock.NewController(t)), - }, - args: args{ - ctx: authz.WithInstanceID(context.Background(), "instanceID"), - userID: "userID", - resourceOwner: "org1", - clientID: "clientID", - backChannelLogoutURI: "backChannelLogoutURI", - audience: []string{"audience"}, - scope: []string{"openid", "offline_access"}, - authMethods: []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, - authTime: testNow, - nonce: "nonce", - preferredLanguage: &language.Afrikaans, - userAgent: &domain.UserAgent{ - FingerprintID: gu.Ptr("fp1"), - IP: net.ParseIP("1.2.3.4"), - Description: gu.Ptr("firefox"), - Header: http.Header{"foo": []string{"bar"}}, - }, - reason: domain.TokenReasonAuthRequest, - actor: &domain.TokenActor{ - UserID: "user2", - Issuer: "foo.com", - }, - needRefreshToken: false, - sessionID: "sessionID", - }, - want: &OIDCSession{ - TokenID: "V2_oidcSessionID-at_accessTokenID", - ClientID: "clientID", - UserID: "userID", - Audience: []string{"audience"}, - Expiration: time.Time{}.Add(time.Hour), - Scope: []string{"openid", "offline_access"}, - AuthMethods: []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, - AuthTime: testNow, - Nonce: "nonce", - PreferredLanguage: &language.Afrikaans, - UserAgent: &domain.UserAgent{ - FingerprintID: gu.Ptr("fp1"), - IP: net.ParseIP("1.2.3.4"), - Description: gu.Ptr("firefox"), - Header: http.Header{"foo": []string{"bar"}}, - }, - Reason: domain.TokenReasonAuthRequest, - Actor: &domain.TokenActor{ - UserID: "user2", - Issuer: "foo.com", - }, - SessionID: "sessionID", - }, - }, - { - name: "with backChannelLogoutURI and sessionID, backchannel logout enabled", fields: fields{ eventstore: expectEventstore( expectFilter( @@ -1484,7 +1383,7 @@ func TestCommands_CreateOIDCSession(t *testing.T) { keyAlgorithm: crypto.CreateMockEncryptionAlg(gomock.NewController(t)), }, args: args{ - ctx: authz.WithFeatures(authz.WithInstanceID(context.Background(), "instanceID"), feature.Features{EnableBackChannelLogout: true}), + ctx: authz.WithInstanceID(context.Background(), "instanceID"), userID: "userID", resourceOwner: "org1", clientID: "clientID", diff --git a/internal/command/system_features.go b/internal/command/system_features.go index 201539f4a..de0982e90 100644 --- a/internal/command/system_features.go +++ b/internal/command/system_features.go @@ -14,7 +14,6 @@ type SystemFeatures struct { UserSchema *bool ImprovedPerformance []feature.ImprovedPerformanceType OIDCSingleV1SessionTermination *bool - EnableBackChannelLogout *bool LoginV2 *feature.LoginV2 PermissionCheckV2 *bool EnableRelationalTables *bool @@ -26,7 +25,6 @@ func (m *SystemFeatures) isEmpty() bool { // nil check to allow unset improvements m.ImprovedPerformance == nil && m.OIDCSingleV1SessionTermination == nil && - m.EnableBackChannelLogout == nil && m.LoginV2 == nil && m.PermissionCheckV2 == nil && m.EnableRelationalTables == nil) diff --git a/internal/command/system_features_model.go b/internal/command/system_features_model.go index 97c353b2d..80de5b97d 100644 --- a/internal/command/system_features_model.go +++ b/internal/command/system_features_model.go @@ -63,7 +63,6 @@ func (m *SystemFeaturesWriteModel) Query() *eventstore.SearchQueryBuilder { feature_v2.SystemUserSchemaEventType, feature_v2.SystemImprovedPerformanceEventType, feature_v2.SystemOIDCSingleV1SessionTerminationEventType, - feature_v2.SystemEnableBackChannelLogout, feature_v2.SystemLoginVersion, feature_v2.SystemPermissionCheckV2, feature_v2.SystemEnableRelationalTables, @@ -90,9 +89,6 @@ func reduceSystemFeature(features *SystemFeatures, key feature.Key, value any) { case feature.KeyOIDCSingleV1SessionTermination: v := value.(bool) features.OIDCSingleV1SessionTermination = &v - case feature.KeyEnableBackChannelLogout: - v := value.(bool) - features.EnableBackChannelLogout = &v case feature.KeyLoginV2: features.LoginV2 = value.(*feature.LoginV2) case feature.KeyPermissionCheckV2: @@ -111,7 +107,6 @@ func (wm *SystemFeaturesWriteModel) setCommands(ctx context.Context, f *SystemFe cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.UserSchema, f.UserSchema, feature_v2.SystemUserSchemaEventType) cmds = appendFeatureSliceUpdate(ctx, cmds, aggregate, wm.ImprovedPerformance, f.ImprovedPerformance, feature_v2.SystemImprovedPerformanceEventType) cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.OIDCSingleV1SessionTermination, f.OIDCSingleV1SessionTermination, feature_v2.SystemOIDCSingleV1SessionTerminationEventType) - cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.EnableBackChannelLogout, f.EnableBackChannelLogout, feature_v2.SystemEnableBackChannelLogout) cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.LoginV2, f.LoginV2, feature_v2.SystemLoginVersion) cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.PermissionCheckV2, f.PermissionCheckV2, feature_v2.SystemPermissionCheckV2) cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.EnableRelationalTables, f.EnableRelationalTables, feature_v2.SystemEnableRelationalTables) diff --git a/internal/command/system_features_test.go b/internal/command/system_features_test.go index 5aa1048cd..6e97be627 100644 --- a/internal/command/system_features_test.go +++ b/internal/command/system_features_test.go @@ -91,12 +91,12 @@ func TestCommands_SetSystemFeatures(t *testing.T) { expectPushFailed(io.ErrClosedPipe, feature_v2.NewSetEvent( context.Background(), aggregate, - feature_v2.SystemEnableBackChannelLogout, true, + feature_v2.SystemPermissionCheckV2, true, ), ), ), args: args{context.Background(), &SystemFeatures{ - EnableBackChannelLogout: gu.Ptr(true), + PermissionCheckV2: gu.Ptr(true), }}, wantErr: io.ErrClosedPipe, }, @@ -291,7 +291,6 @@ func TestSystemFeatures_isEmpty(t *testing.T) { {name: "UserSchema set", sysFeatures: &SystemFeatures{UserSchema: gu.Ptr(true)}, want: false}, {name: "ImprovedPerformance set", sysFeatures: &SystemFeatures{ImprovedPerformance: []feature.ImprovedPerformanceType{}}, want: false}, {name: "OIDCSingleV1SessionTermination set", sysFeatures: &SystemFeatures{OIDCSingleV1SessionTermination: gu.Ptr(true)}, want: false}, - {name: "EnableBackChannelLogout set", sysFeatures: &SystemFeatures{EnableBackChannelLogout: gu.Ptr(true)}, want: false}, {name: "LoginV2 set", sysFeatures: &SystemFeatures{LoginV2: &feature.LoginV2{}}, want: false}, {name: "PermissionCheckV2 set", sysFeatures: &SystemFeatures{PermissionCheckV2: gu.Ptr(true)}, want: false}, {name: "EnableRelationalTables set", sysFeatures: &SystemFeatures{EnableRelationalTables: gu.Ptr(true)}, want: false}, diff --git a/internal/feature/feature.go b/internal/feature/feature.go index b9de97ad2..1f5944bd1 100644 --- a/internal/feature/feature.go +++ b/internal/feature/feature.go @@ -9,7 +9,7 @@ import ( type Key int const ( - // Reserved: 2, 3, 5, 6, 8, 11 + // Reserved: 2, 3, 5, 6, 8, 11, 12 KeyUnspecified Key = 0 KeyLoginDefaultOrg Key = 1 @@ -17,7 +17,6 @@ const ( KeyImprovedPerformance Key = 7 KeyDebugOIDCParentError Key = 9 KeyOIDCSingleV1SessionTermination Key = 10 - KeyEnableBackChannelLogout Key = 12 KeyLoginV2 Key = 13 KeyPermissionCheckV2 Key = 14 KeyManagementConsoleUseV2UserApi Key = 15 @@ -44,7 +43,6 @@ type Features struct { DebugOIDCParentError bool `json:"debug_oidc_parent_error,omitempty"` OIDCSingleV1SessionTermination bool `json:"oidc_single_v1_session_termination,omitempty"` DisableUserTokenEvent bool `json:"disable_user_token_event,omitempty"` - EnableBackChannelLogout bool `json:"enable_back_channel_logout,omitempty"` LoginV2 LoginV2 `json:"login_v2,omitempty"` PermissionCheckV2 bool `json:"permission_check_v2,omitempty"` ConsoleUseV2UserApi bool `json:"console_use_v2_user_api,omitempty"` diff --git a/internal/feature/key_enumer.go b/internal/feature/key_enumer.go index b12b6d521..aab7e6180 100644 --- a/internal/feature/key_enumer.go +++ b/internal/feature/key_enumer.go @@ -16,8 +16,8 @@ const ( _KeyLowerName_2 = "improved_performance" _KeyName_3 = "debug_oidc_parent_erroroidc_single_v1_session_termination" _KeyLowerName_3 = "debug_oidc_parent_erroroidc_single_v1_session_termination" - _KeyName_4 = "enable_back_channel_logoutlogin_v2permission_check_v2management_console_use_v2_user_apienable_relational_tables" - _KeyLowerName_4 = "enable_back_channel_logoutlogin_v2permission_check_v2management_console_use_v2_user_apienable_relational_tables" + _KeyName_4 = "login_v2permission_check_v2management_console_use_v2_user_apienable_relational_tables" + _KeyLowerName_4 = "login_v2permission_check_v2management_console_use_v2_user_apienable_relational_tables" ) var ( @@ -25,7 +25,7 @@ var ( _KeyIndex_1 = [...]uint8{0, 11} _KeyIndex_2 = [...]uint8{0, 20} _KeyIndex_3 = [...]uint8{0, 23, 57} - _KeyIndex_4 = [...]uint8{0, 26, 34, 53, 87, 111} + _KeyIndex_4 = [...]uint8{0, 8, 27, 61, 85} ) func (i Key) String() string { @@ -39,8 +39,8 @@ func (i Key) String() string { case 9 <= i && i <= 10: i -= 9 return _KeyName_3[_KeyIndex_3[i]:_KeyIndex_3[i+1]] - case 12 <= i && i <= 16: - i -= 12 + case 13 <= i && i <= 16: + i -= 13 return _KeyName_4[_KeyIndex_4[i]:_KeyIndex_4[i+1]] default: return fmt.Sprintf("Key(%d)", i) @@ -57,38 +57,35 @@ func _KeyNoOp() { _ = x[KeyImprovedPerformance-(7)] _ = x[KeyDebugOIDCParentError-(9)] _ = x[KeyOIDCSingleV1SessionTermination-(10)] - _ = x[KeyEnableBackChannelLogout-(12)] _ = x[KeyLoginV2-(13)] _ = x[KeyPermissionCheckV2-(14)] _ = x[KeyManagementConsoleUseV2UserApi-(15)] _ = x[KeyEnableRelationalTables-(16)] } -var _KeyValues = []Key{KeyUnspecified, KeyLoginDefaultOrg, KeyUserSchema, KeyImprovedPerformance, KeyDebugOIDCParentError, KeyOIDCSingleV1SessionTermination, KeyEnableBackChannelLogout, KeyLoginV2, KeyPermissionCheckV2, KeyManagementConsoleUseV2UserApi, KeyEnableRelationalTables} +var _KeyValues = []Key{KeyUnspecified, KeyLoginDefaultOrg, KeyUserSchema, KeyImprovedPerformance, KeyDebugOIDCParentError, KeyOIDCSingleV1SessionTermination, KeyLoginV2, KeyPermissionCheckV2, KeyManagementConsoleUseV2UserApi, KeyEnableRelationalTables} var _KeyNameToValueMap = map[string]Key{ - _KeyName_0[0:11]: KeyUnspecified, - _KeyLowerName_0[0:11]: KeyUnspecified, - _KeyName_0[11:28]: KeyLoginDefaultOrg, - _KeyLowerName_0[11:28]: KeyLoginDefaultOrg, - _KeyName_1[0:11]: KeyUserSchema, - _KeyLowerName_1[0:11]: KeyUserSchema, - _KeyName_2[0:20]: KeyImprovedPerformance, - _KeyLowerName_2[0:20]: KeyImprovedPerformance, - _KeyName_3[0:23]: KeyDebugOIDCParentError, - _KeyLowerName_3[0:23]: KeyDebugOIDCParentError, - _KeyName_3[23:57]: KeyOIDCSingleV1SessionTermination, - _KeyLowerName_3[23:57]: KeyOIDCSingleV1SessionTermination, - _KeyName_4[0:26]: KeyEnableBackChannelLogout, - _KeyLowerName_4[0:26]: KeyEnableBackChannelLogout, - _KeyName_4[26:34]: KeyLoginV2, - _KeyLowerName_4[26:34]: KeyLoginV2, - _KeyName_4[34:53]: KeyPermissionCheckV2, - _KeyLowerName_4[34:53]: KeyPermissionCheckV2, - _KeyName_4[53:87]: KeyManagementConsoleUseV2UserApi, - _KeyLowerName_4[53:87]: KeyManagementConsoleUseV2UserApi, - _KeyName_4[87:111]: KeyEnableRelationalTables, - _KeyLowerName_4[87:111]: KeyEnableRelationalTables, + _KeyName_0[0:11]: KeyUnspecified, + _KeyLowerName_0[0:11]: KeyUnspecified, + _KeyName_0[11:28]: KeyLoginDefaultOrg, + _KeyLowerName_0[11:28]: KeyLoginDefaultOrg, + _KeyName_1[0:11]: KeyUserSchema, + _KeyLowerName_1[0:11]: KeyUserSchema, + _KeyName_2[0:20]: KeyImprovedPerformance, + _KeyLowerName_2[0:20]: KeyImprovedPerformance, + _KeyName_3[0:23]: KeyDebugOIDCParentError, + _KeyLowerName_3[0:23]: KeyDebugOIDCParentError, + _KeyName_3[23:57]: KeyOIDCSingleV1SessionTermination, + _KeyLowerName_3[23:57]: KeyOIDCSingleV1SessionTermination, + _KeyName_4[0:8]: KeyLoginV2, + _KeyLowerName_4[0:8]: KeyLoginV2, + _KeyName_4[8:27]: KeyPermissionCheckV2, + _KeyLowerName_4[8:27]: KeyPermissionCheckV2, + _KeyName_4[27:61]: KeyManagementConsoleUseV2UserApi, + _KeyLowerName_4[27:61]: KeyManagementConsoleUseV2UserApi, + _KeyName_4[61:85]: KeyEnableRelationalTables, + _KeyLowerName_4[61:85]: KeyEnableRelationalTables, } var _KeyNames = []string{ @@ -98,11 +95,10 @@ var _KeyNames = []string{ _KeyName_2[0:20], _KeyName_3[0:23], _KeyName_3[23:57], - _KeyName_4[0:26], - _KeyName_4[26:34], - _KeyName_4[34:53], - _KeyName_4[53:87], - _KeyName_4[87:111], + _KeyName_4[0:8], + _KeyName_4[8:27], + _KeyName_4[27:61], + _KeyName_4[61:85], } // KeyString retrieves an enum value from the enum constants string name. diff --git a/internal/notification/handlers/back_channel_logout.go b/internal/notification/handlers/back_channel_logout.go index 6437135e0..204c22231 100644 --- a/internal/notification/handlers/back_channel_logout.go +++ b/internal/notification/handlers/back_channel_logout.go @@ -4,7 +4,6 @@ import ( "context" "slices" - "github.com/zitadel/zitadel/internal/api/authz" http_util "github.com/zitadel/zitadel/internal/api/http" "github.com/zitadel/zitadel/internal/eventstore" "github.com/zitadel/zitadel/internal/eventstore/handler/v2" @@ -75,17 +74,10 @@ func (u *backChannelLogoutNotifier) reduceUserSignedOut(event eventstore.Event) } return handler.NewStatement(event, func(ctx context.Context, ex handler.Executer, projectionName string) error { - ctx, err := u.queries.HandlerContext(ctx, event.Aggregate()) - if err != nil { - return err - } - if !authz.GetFeatures(ctx).EnableBackChannelLogout { - return nil - } if e.SessionID == "" { return nil } - ctx, err = u.queries.Origin(ctx, e) + ctx, err := u.queries.Origin(ctx, e) if err != nil { return err } @@ -109,14 +101,7 @@ func (u *backChannelLogoutNotifier) reduceSessionTerminated(event eventstore.Eve } return handler.NewStatement(event, func(ctx context.Context, ex handler.Executer, projectionName string) error { - ctx, err := u.queries.HandlerContext(ctx, event.Aggregate()) - if err != nil { - return err - } - if !authz.GetFeatures(ctx).EnableBackChannelLogout { - return nil - } - ctx, err = u.queries.Origin(ctx, e) + ctx, err := u.queries.Origin(ctx, e) if err != nil { return err } diff --git a/internal/query/instance_by_domain.sql b/internal/query/instance_by_domain.sql index d13e062c9..c7065c028 100644 --- a/internal/query/instance_by_domain.sql +++ b/internal/query/instance_by_domain.sql @@ -6,14 +6,14 @@ with domain as ( ), instance_features as ( select i.* from domain d - join projections.instance_features4 i on d.instance_id = i.instance_id + join projections.instance_features5 i on d.instance_id = i.instance_id ), features as ( select instance_id, json_object_agg( coalesce(i.key, s.key), coalesce(i.value, s.value) ) features from domain d - cross join projections.system_features3 s + cross join projections.system_features4 s full outer join instance_features i using (instance_id, key) group by instance_id ), external_domains as ( diff --git a/internal/query/instance_by_id.sql b/internal/query/instance_by_id.sql index 9f56bfba3..2b9118c59 100644 --- a/internal/query/instance_by_id.sql +++ b/internal/query/instance_by_id.sql @@ -4,8 +4,8 @@ with features as ( coalesce(i.value, s.value) ) features from (select $1::text instance_id) x - cross join projections.system_features3 s - full outer join projections.instance_features4 i using (key, instance_id) + cross join projections.system_features4 s + full outer join projections.instance_features5 i using (key, instance_id) group by instance_id ), external_domains as ( select instance_id, array_agg(domain) as domains diff --git a/internal/query/instance_features.go b/internal/query/instance_features.go index a001e16cb..98dc638a3 100644 --- a/internal/query/instance_features.go +++ b/internal/query/instance_features.go @@ -14,7 +14,6 @@ type InstanceFeatures struct { ImprovedPerformance FeatureSource[[]feature.ImprovedPerformanceType] DebugOIDCParentError FeatureSource[bool] OIDCSingleV1SessionTermination FeatureSource[bool] - EnableBackChannelLogout FeatureSource[bool] LoginV2 FeatureSource[*feature.LoginV2] PermissionCheckV2 FeatureSource[bool] ManagementConsoleUseV2UserApi FeatureSource[bool] diff --git a/internal/query/instance_features_model.go b/internal/query/instance_features_model.go index a003f257a..11402d356 100644 --- a/internal/query/instance_features_model.go +++ b/internal/query/instance_features_model.go @@ -67,7 +67,6 @@ func (m *InstanceFeaturesReadModel) Query() *eventstore.SearchQueryBuilder { feature_v2.InstanceImprovedPerformanceEventType, feature_v2.InstanceDebugOIDCParentErrorEventType, feature_v2.InstanceOIDCSingleV1SessionTerminationEventType, - feature_v2.InstanceEnableBackChannelLogout, feature_v2.InstanceLoginVersion, feature_v2.InstancePermissionCheckV2, feature_v2.InstanceManagementConsoleUseV2UserApi, @@ -93,7 +92,6 @@ func (m *InstanceFeaturesReadModel) populateFromSystem() bool { m.instance.UserSchema = m.system.UserSchema m.instance.ImprovedPerformance = m.system.ImprovedPerformance m.instance.OIDCSingleV1SessionTermination = m.system.OIDCSingleV1SessionTermination - m.instance.EnableBackChannelLogout = m.system.EnableBackChannelLogout m.instance.LoginV2 = m.system.LoginV2 return true } @@ -116,8 +114,6 @@ func reduceInstanceFeatureSet[T any](features *InstanceFeatures, event *feature_ features.DebugOIDCParentError.set(level, event.Value) case feature.KeyOIDCSingleV1SessionTermination: features.OIDCSingleV1SessionTermination.set(level, event.Value) - case feature.KeyEnableBackChannelLogout: - features.EnableBackChannelLogout.set(level, event.Value) case feature.KeyLoginV2: features.LoginV2.set(level, event.Value) case feature.KeyPermissionCheckV2: diff --git a/internal/query/projection/instance_features.go b/internal/query/projection/instance_features.go index 915630404..3db8da42a 100644 --- a/internal/query/projection/instance_features.go +++ b/internal/query/projection/instance_features.go @@ -14,7 +14,7 @@ import ( ) const ( - InstanceFeatureTable = "projections.instance_features4" + InstanceFeatureTable = "projections.instance_features5" InstanceFeatureInstanceIDCol = "instance_id" InstanceFeatureKeyCol = "key" @@ -80,10 +80,6 @@ func (*instanceFeatureProjection) Reducers() []handler.AggregateReducer { Event: feature_v2.InstanceOIDCSingleV1SessionTerminationEventType, Reduce: reduceInstanceSetFeature[bool], }, - { - Event: feature_v2.InstanceEnableBackChannelLogout, - Reduce: reduceInstanceSetFeature[bool], - }, { Event: feature_v2.InstanceLoginVersion, Reduce: reduceInstanceSetFeature[*feature.LoginV2], diff --git a/internal/query/projection/instance_features_test.go b/internal/query/projection/instance_features_test.go index feaf43842..5f3e16169 100644 --- a/internal/query/projection/instance_features_test.go +++ b/internal/query/projection/instance_features_test.go @@ -38,7 +38,7 @@ func TestInstanceFeaturesProjection_reduces(t *testing.T) { executer: &testExecuter{ executions: []execution{ { - expectedStmt: "INSERT INTO projections.instance_features4 (instance_id, key, creation_date, change_date, sequence, value) VALUES ($1, $2, $3, $4, $5, $6) ON CONFLICT (instance_id, key) DO UPDATE SET (creation_date, change_date, sequence, value) = (projections.instance_features4.creation_date, EXCLUDED.change_date, EXCLUDED.sequence, EXCLUDED.value)", + expectedStmt: "INSERT INTO projections.instance_features5 (instance_id, key, creation_date, change_date, sequence, value) VALUES ($1, $2, $3, $4, $5, $6) ON CONFLICT (instance_id, key) DO UPDATE SET (creation_date, change_date, sequence, value) = (projections.instance_features5.creation_date, EXCLUDED.change_date, EXCLUDED.sequence, EXCLUDED.value)", expectedArgs: []interface{}{ "agg-id", "user_schema", @@ -69,7 +69,7 @@ func TestInstanceFeaturesProjection_reduces(t *testing.T) { executer: &testExecuter{ executions: []execution{ { - expectedStmt: "INSERT INTO projections.instance_features4 (instance_id, key, creation_date, change_date, sequence, value) VALUES ($1, $2, $3, $4, $5, $6) ON CONFLICT (instance_id, key) DO UPDATE SET (creation_date, change_date, sequence, value) = (projections.instance_features4.creation_date, EXCLUDED.change_date, EXCLUDED.sequence, EXCLUDED.value)", + expectedStmt: "INSERT INTO projections.instance_features5 (instance_id, key, creation_date, change_date, sequence, value) VALUES ($1, $2, $3, $4, $5, $6) ON CONFLICT (instance_id, key) DO UPDATE SET (creation_date, change_date, sequence, value) = (projections.instance_features5.creation_date, EXCLUDED.change_date, EXCLUDED.sequence, EXCLUDED.value)", expectedArgs: []interface{}{ "instance-id", "login_default_org", @@ -100,7 +100,7 @@ func TestInstanceFeaturesProjection_reduces(t *testing.T) { executer: &testExecuter{ executions: []execution{ { - expectedStmt: "DELETE FROM projections.instance_features4 WHERE (instance_id = $1)", + expectedStmt: "DELETE FROM projections.instance_features5 WHERE (instance_id = $1)", expectedArgs: []interface{}{ "agg-id", }, @@ -126,7 +126,7 @@ func TestInstanceFeaturesProjection_reduces(t *testing.T) { executer: &testExecuter{ executions: []execution{ { - expectedStmt: "DELETE FROM projections.instance_features4 WHERE (instance_id = $1)", + expectedStmt: "DELETE FROM projections.instance_features5 WHERE (instance_id = $1)", expectedArgs: []interface{}{ "agg-id", }, diff --git a/internal/query/projection/system_features.go b/internal/query/projection/system_features.go index 3537fdad4..1874bb396 100644 --- a/internal/query/projection/system_features.go +++ b/internal/query/projection/system_features.go @@ -12,7 +12,7 @@ import ( ) const ( - SystemFeatureTable = "projections.system_features3" + SystemFeatureTable = "projections.system_features4" SystemFeatureKeyCol = "key" SystemFeatureCreationDateCol = "creation_date" @@ -64,10 +64,6 @@ func (*systemFeatureProjection) Reducers() []handler.AggregateReducer { Event: feature_v2.SystemImprovedPerformanceEventType, Reduce: reduceSystemSetFeature[[]feature.ImprovedPerformanceType], }, - { - Event: feature_v2.SystemEnableBackChannelLogout, - Reduce: reduceSystemSetFeature[bool], - }, { Event: feature_v2.SystemLoginVersion, Reduce: reduceSystemSetFeature[*feature.LoginV2], diff --git a/internal/query/projection/system_features_test.go b/internal/query/projection/system_features_test.go index 0308eb784..4b9e6a094 100644 --- a/internal/query/projection/system_features_test.go +++ b/internal/query/projection/system_features_test.go @@ -36,7 +36,7 @@ func TestSystemFeaturesProjection_reduces(t *testing.T) { executer: &testExecuter{ executions: []execution{ { - expectedStmt: "INSERT INTO projections.system_features3 (key, creation_date, change_date, sequence, value) VALUES ($1, $2, $3, $4, $5) ON CONFLICT (key) DO UPDATE SET (creation_date, change_date, sequence, value) = (projections.system_features3.creation_date, EXCLUDED.change_date, EXCLUDED.sequence, EXCLUDED.value)", + expectedStmt: "INSERT INTO projections.system_features4 (key, creation_date, change_date, sequence, value) VALUES ($1, $2, $3, $4, $5) ON CONFLICT (key) DO UPDATE SET (creation_date, change_date, sequence, value) = (projections.system_features4.creation_date, EXCLUDED.change_date, EXCLUDED.sequence, EXCLUDED.value)", expectedArgs: []interface{}{ "user_schema", anyArg{}, @@ -66,7 +66,7 @@ func TestSystemFeaturesProjection_reduces(t *testing.T) { executer: &testExecuter{ executions: []execution{ { - expectedStmt: "DELETE FROM projections.system_features3 WHERE (key IS NOT NULL)", + expectedStmt: "DELETE FROM projections.system_features4 WHERE (key IS NOT NULL)", expectedArgs: []interface{}{}, }, }, diff --git a/internal/query/system_features.go b/internal/query/system_features.go index 9f97a2257..866892168 100644 --- a/internal/query/system_features.go +++ b/internal/query/system_features.go @@ -24,7 +24,6 @@ type SystemFeatures struct { UserSchema FeatureSource[bool] ImprovedPerformance FeatureSource[[]feature.ImprovedPerformanceType] OIDCSingleV1SessionTermination FeatureSource[bool] - EnableBackChannelLogout FeatureSource[bool] LoginV2 FeatureSource[*feature.LoginV2] PermissionCheckV2 FeatureSource[bool] EnableRelationalTables FeatureSource[bool] diff --git a/internal/query/system_features_model.go b/internal/query/system_features_model.go index efbf7d080..fab91e8e7 100644 --- a/internal/query/system_features_model.go +++ b/internal/query/system_features_model.go @@ -59,7 +59,6 @@ func (m *SystemFeaturesReadModel) Query() *eventstore.SearchQueryBuilder { feature_v2.SystemUserSchemaEventType, feature_v2.SystemImprovedPerformanceEventType, feature_v2.SystemOIDCSingleV1SessionTerminationEventType, - feature_v2.SystemEnableBackChannelLogout, feature_v2.SystemLoginVersion, feature_v2.SystemPermissionCheckV2, feature_v2.SystemEnableRelationalTables, @@ -88,8 +87,6 @@ func reduceSystemFeatureSet[T any](features *SystemFeatures, event *feature_v2.S features.ImprovedPerformance.set(level, event.Value) case feature.KeyOIDCSingleV1SessionTermination: features.OIDCSingleV1SessionTermination.set(level, event.Value) - case feature.KeyEnableBackChannelLogout: - features.EnableBackChannelLogout.set(level, event.Value) case feature.KeyLoginV2: features.LoginV2.set(level, event.Value) case feature.KeyPermissionCheckV2: diff --git a/internal/repository/feature/feature_v2/eventstore.go b/internal/repository/feature/feature_v2/eventstore.go index bedc1fc2e..a4adbdc7f 100644 --- a/internal/repository/feature/feature_v2/eventstore.go +++ b/internal/repository/feature/feature_v2/eventstore.go @@ -11,7 +11,6 @@ func init() { eventstore.RegisterFilterEventMapper(AggregateType, SystemUserSchemaEventType, eventstore.GenericEventMapper[SetEvent[bool]]) eventstore.RegisterFilterEventMapper(AggregateType, SystemImprovedPerformanceEventType, eventstore.GenericEventMapper[SetEvent[[]feature.ImprovedPerformanceType]]) eventstore.RegisterFilterEventMapper(AggregateType, SystemOIDCSingleV1SessionTerminationEventType, eventstore.GenericEventMapper[SetEvent[bool]]) - eventstore.RegisterFilterEventMapper(AggregateType, SystemEnableBackChannelLogout, eventstore.GenericEventMapper[SetEvent[bool]]) eventstore.RegisterFilterEventMapper(AggregateType, SystemLoginVersion, eventstore.GenericEventMapper[SetEvent[*feature.LoginV2]]) eventstore.RegisterFilterEventMapper(AggregateType, SystemPermissionCheckV2, eventstore.GenericEventMapper[SetEvent[bool]]) eventstore.RegisterFilterEventMapper(AggregateType, SystemEnableRelationalTables, eventstore.GenericEventMapper[SetEvent[bool]]) @@ -22,7 +21,6 @@ func init() { eventstore.RegisterFilterEventMapper(AggregateType, InstanceImprovedPerformanceEventType, eventstore.GenericEventMapper[SetEvent[[]feature.ImprovedPerformanceType]]) eventstore.RegisterFilterEventMapper(AggregateType, InstanceDebugOIDCParentErrorEventType, eventstore.GenericEventMapper[SetEvent[bool]]) eventstore.RegisterFilterEventMapper(AggregateType, InstanceOIDCSingleV1SessionTerminationEventType, eventstore.GenericEventMapper[SetEvent[bool]]) - eventstore.RegisterFilterEventMapper(AggregateType, InstanceEnableBackChannelLogout, eventstore.GenericEventMapper[SetEvent[bool]]) eventstore.RegisterFilterEventMapper(AggregateType, InstanceLoginVersion, eventstore.GenericEventMapper[SetEvent[*feature.LoginV2]]) eventstore.RegisterFilterEventMapper(AggregateType, InstancePermissionCheckV2, eventstore.GenericEventMapper[SetEvent[bool]]) eventstore.RegisterFilterEventMapper(AggregateType, InstanceManagementConsoleUseV2UserApi, eventstore.GenericEventMapper[SetEvent[bool]]) diff --git a/internal/repository/feature/feature_v2/feature.go b/internal/repository/feature/feature_v2/feature.go index 2e8cd4498..24d499a86 100644 --- a/internal/repository/feature/feature_v2/feature.go +++ b/internal/repository/feature/feature_v2/feature.go @@ -16,7 +16,6 @@ var ( SystemUserSchemaEventType = setEventTypeFromFeature(feature.LevelSystem, feature.KeyUserSchema) SystemImprovedPerformanceEventType = setEventTypeFromFeature(feature.LevelSystem, feature.KeyImprovedPerformance) SystemOIDCSingleV1SessionTerminationEventType = setEventTypeFromFeature(feature.LevelSystem, feature.KeyOIDCSingleV1SessionTermination) - SystemEnableBackChannelLogout = setEventTypeFromFeature(feature.LevelSystem, feature.KeyEnableBackChannelLogout) SystemLoginVersion = setEventTypeFromFeature(feature.LevelSystem, feature.KeyLoginV2) SystemPermissionCheckV2 = setEventTypeFromFeature(feature.LevelSystem, feature.KeyPermissionCheckV2) SystemEnableRelationalTables = setEventTypeFromFeature(feature.LevelSystem, feature.KeyEnableRelationalTables) @@ -27,7 +26,6 @@ var ( InstanceImprovedPerformanceEventType = setEventTypeFromFeature(feature.LevelInstance, feature.KeyImprovedPerformance) InstanceDebugOIDCParentErrorEventType = setEventTypeFromFeature(feature.LevelInstance, feature.KeyDebugOIDCParentError) InstanceOIDCSingleV1SessionTerminationEventType = setEventTypeFromFeature(feature.LevelInstance, feature.KeyOIDCSingleV1SessionTermination) - InstanceEnableBackChannelLogout = setEventTypeFromFeature(feature.LevelInstance, feature.KeyEnableBackChannelLogout) InstanceLoginVersion = setEventTypeFromFeature(feature.LevelInstance, feature.KeyLoginV2) InstancePermissionCheckV2 = setEventTypeFromFeature(feature.LevelInstance, feature.KeyPermissionCheckV2) InstanceManagementConsoleUseV2UserApi = setEventTypeFromFeature(feature.LevelInstance, feature.KeyManagementConsoleUseV2UserApi) diff --git a/proto/zitadel/feature/v2/instance.proto b/proto/zitadel/feature/v2/instance.proto index bd434943b..f416df2b7 100644 --- a/proto/zitadel/feature/v2/instance.proto +++ b/proto/zitadel/feature/v2/instance.proto @@ -61,11 +61,11 @@ message SetInstanceFeaturesRequest{ } ]; + // Deprecated: the flag has been removed and OIDC Back-Channel Logout is always enabled. + // This field is only kept for backward compatibility and will be removed in the next major version of Zitadel. + // Setting the field will have no effect. optional bool enable_back_channel_logout = 12 [ - (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { - example: "true"; - description: "If the flag is enabled, you'll be able to use the OIDC Back-Channel Logout to be notified in your application about terminated user sessions."; - } + deprecated = true ]; optional LoginV2 login_v2 = 13 [ @@ -164,11 +164,10 @@ message GetInstanceFeaturesResponse { } ]; + // Deprecated: the flag has been removed and OIDC Back-Channel Logout is always enabled. + // This field is only kept for backward compatibility and will be removed in the next major version of Zitadel. FeatureFlag enable_back_channel_logout = 13 [ - (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { - example: "true"; - description: "If the flag is enabled, you'll be able to use the OIDC Back-Channel Logout to be notified in your application about terminated user sessions."; - } + deprecated = true ]; LoginV2FeatureFlag login_v2 = 14 [ diff --git a/proto/zitadel/feature/v2/system.proto b/proto/zitadel/feature/v2/system.proto index d99a77585..5b6490071 100644 --- a/proto/zitadel/feature/v2/system.proto +++ b/proto/zitadel/feature/v2/system.proto @@ -54,11 +54,11 @@ message SetSystemFeaturesRequest{ } ]; + // Deprecated: the flag has been removed and OIDC Back-Channel Logout is always enabled. + // This field is only kept for backward compatibility and will be removed in the next major version of Zitadel. + // Setting the field will have no effect. optional bool enable_back_channel_logout = 10 [ - (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { - example: "true"; - description: "If the flag is enabled, you'll be able to use the OIDC Back-Channel Logout to be notified in your application about terminated user sessions."; - } + deprecated = true ]; optional LoginV2 login_v2 = 11 [ @@ -137,11 +137,10 @@ message GetSystemFeaturesResponse { } ]; + // Deprecated: the flag has been removed and OIDC Back-Channel Logout is always enabled. + // This field is only kept for backward compatibility and will be removed in the next major version of Zitadel. FeatureFlag enable_back_channel_logout = 11 [ - (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { - example: "true"; - description: "If the flag is enabled, you'll be able to use the OIDC Back-Channel Logout to be notified in your application about terminated user sessions."; - } + deprecated = true ]; LoginV2FeatureFlag login_v2 = 12 [