mirror of
https://github.com/andwati/zitadel.git
synced 2026-11-08 23:25:12 +00:00
d8ea041c56
## Todos for release - [x] Configure Env in docs project on vercel - [x] Configure Root Path in the docs project on vercel - [ ] Remove old CSP https://github.com/zitadel/website/pull/1592 ## What we did This pull request migrates the project documentation from the old `docs/` directory to the new `apps/docs/` directory, introduces a new documentation system built with Next.js and Fumadocs, and updates all relevant references, configuration files, and documentation to reflect this change. It also adds new configuration and ignore files for the new documentation app, updates CI and linting to exclude the new docs from certain checks, and revises the contributing guidelines accordingly. **Documentation System Migration and New Docs App** * Migrated all documentation from `docs/` to `apps/docs/`, and updated all references in `README.md`, `CONTRIBUTING.md`, and other files to point to the new location. [[1]](diffhunk://#diff-eca12c0a30e25b4b46522ebf89465a03ba72a03f540796c979137931d8f92055L585-L640) [[2]](diffhunk://#diff-eca12c0a30e25b4b46522ebf89465a03ba72a03f540796c979137931d8f92055L660-R607) [[3]](diffhunk://#diff-eca12c0a30e25b4b46522ebf89465a03ba72a03f540796c979137931d8f92055L740-R687) [[4]](diffhunk://#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5L2-R3) [[5]](diffhunk://#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5L30-R30) * Added a new Next.js/Fumadocs-based documentation app under `apps/docs/`, including core app files, layouts, routing, search API, and a comprehensive `README.md` with development and contribution instructions. [[1]](diffhunk://#diff-5a1b07344a2c1b4d3f37b23ff1388b62cd9f57dea3c1cd23d8a0412b7602b132R1-R74) [[2]](diffhunk://#diff-462b9ad1eabbb7d1c29bb9c36e4931eb180fd7190900e6d2babf8f4d66ad1c28R1-R39) [[3]](diffhunk://#diff-e16ae25660ded787b10ac35dea96d5ecaacf895dae0afc8a9bd4382dc79a8c87R1-R7) [apps/docs/app/[[...slug]]/layout.tsxR1-R81](diffhunk://#diff-59e08acde4e805b7aeccef1dcf98f1d71dfc550777e6b9402085cee0e9fa4e0aR1-R81), [apps/docs/app/[[...slug]]/page.tsxR1-R79](diffhunk://#diff-e5df3f80d0fa01e12d63d81f29c57a9d14e846c78fd3beabb2ef768e38fd9580R1-R79), [[4]](diffhunk://#diff-389b34918e040cacaa87cd7201ffa462cc2b0b716736f537e3d3c660ac69353bR1-R7) [[5]](diffhunk://#diff-d3b03416d1c457b19f1c27b26f2db741412df841b875c26ccadc36e4522247f4R1-R29) [[6]](diffhunk://#diff-c8fb8339570a5305809be7c618e14705fd86390dc278e6ce8ba224a7bc8b0c3cR1-R25) **Configuration and Tooling Updates** * Updated `.github/workflows/codeql.yml`, `.golangci.yaml`, and `.github/dependabot.yml` to properly handle the new docs app: excluded `apps/docs` from certain checks, added npm dependency updates for the docs app, and excluded generated content. [[1]](diffhunk://#diff-12783128521e452af0cfac94b99b8d250413c516ec71fe6d97dbea666ff7ba27L8-R14) [[2]](diffhunk://#diff-9917ddc9f1c3304218f7269265b746d997c5c0615478177b5fceecd33ef47cb5R5-R6) [[3]](diffhunk://#diff-9917ddc9f1c3304218f7269265b746d997c5c0615478177b5fceecd33ef47cb5R126-R129) [[4]](diffhunk://#diff-dd4fbda47e51f1e35defb9275a9cd9c212ecde0b870cba89ddaaae65c5f3cd28R89-R106) * Updated `.devcontainer/devcontainer.json` to use the latest Go 1.25.3 version for consistency. **Licensing and Miscellaneous** * Added `apps/docs/` to the list of licensed directories in `LICENSING.md`. These changes ensure the documentation is now maintained in a modern, scalable system and all project tooling is updated to support the new structure. --------- Co-authored-by: Federico Coppede <[email protected]>
76 lines
3.4 KiB
Plaintext
76 lines
3.4 KiB
Plaintext
---
|
|
title: Log Out Users from an Application with ZITADEL
|
|
sidebar_label: Logout
|
|
---
|
|
|
|
This guide shows you the different concepts and use cases of the logout process and how to use it in ZITADEL.
|
|
|
|
## OpenID Connect Single Logout
|
|
|
|
### Single Sign On (SSO) vs Single Logout (SLO)
|
|
|
|
Single Sign On (SSO) allows a user to login once without the need for authentication across multiple applications.
|
|
Single Logout (SLO) is the counterpart to SSO. With SLO a user can logout and terminate sessions across many applications, without actively logging out from them.
|
|
|
|
The purpose of a logout is to terminate a user session.
|
|
Depending on how the session handling is implemented, there are different mechanisms that can be used.
|
|
There are two possibilities where sessions are stored:
|
|
- The User Agent (e.g the Browser or Mobile App) stores the session information (e.g. in a cookie)
|
|
- A Server stores the session information (e.g. in a database or api)
|
|
|
|
### OpenID Connect Logout
|
|
|
|
OpenID Connect defines three logout mechanisms to address the different architectures:
|
|
- [OpenID Connect Session Management 1.0](https://openid.net/specs/openid-connect-session-1_0.html)
|
|
- [OpenID Connect Front-Channel Logout 1.0](https://openid.net/specs/openid-connect-frontchannel-1_0.html)
|
|
- [OpenID Connect Back-Channel Logout 1.0](https://openid.net/specs/openid-connect-backchannel-1_0.html)
|
|
|
|
#### Session Management
|
|
|
|
Session Management in OpenID Connect defines a mechanism for a client (Relying Party, RP) to monitor the state of the user session from a identity provider (OP, e.g ZITADEL).
|
|
When a user logs out of the provider, the user's session is terminated and the client can in turn reflect that in its behavior.
|
|
|
|
#### RP initiated Logout
|
|
|
|
With the RP initiated flow all logout processes are triggered by a request from the client (e.g your application) through a well defined standard API by redirecting the user-agent to the [end_session_endpoint](/apis/openidoauth/endpoints#end-session-endpoint).
|
|
If you have specified some post_logout_redirect_uris on your client you have to send either the id_token_hint or the client_id as param in your request.
|
|
So ZITADEL is able to read the configured redirect uris.
|
|
|
|
```
|
|
GET ${CUSTOM_DOMAIN}/oidc/v1/end_session
|
|
?id_token_hint={id_token}
|
|
&post_logout_redirect_uri=https://rp.example.com/logged_out
|
|
&state=random_string
|
|
```
|
|
|
|
#### Front-Channel Logout
|
|
|
|
The user agent handles the front-channel logout.
|
|
Each client with an OpenID Session of the user that supports front-channel renders an iframe so the logout request is performed on all clients parallel.
|
|
|
|
<Callout>
|
|
This is not yet implemented in ZITADEL
|
|
</Callout>
|
|
|
|
#### Back-Channel Logout
|
|
|
|
The back-channel logout is a mechanism on the server-side and the user agent does not have to do anything.
|
|
The user will logout from all clients even in the case the user agent was closed.
|
|
|
|
<Callout>
|
|
This is not yet implemented in ZITADEL
|
|
</Callout>
|
|
|
|
## Scenarios
|
|
|
|
1. Logout all users from the current user-agent/browser (current implementation of ZITADEL end_session_endpoint)
|
|
2. Logout my user from the current user-agent/browser
|
|
3. Logout my user from the all devices
|
|
|
|
## Session Handling in ZITADEL
|
|
|
|
The session management in ZITADEL is done on the server side.
|
|
As soon as a user authenticates the first time, ZITADEL generates a user-agent cookie.
|
|
All open sessions on that user-agent (browser) will be stored to the same cookie.
|
|
If you delete the cookie in your browser, we will not be able to find out which sessions belong to your user-agent.
|