SSO Logout Frustrations
I've been integrating Authentik OIDC SSO with my self-hosted services and am frustrated by the logout behavior of some services. Specifically, Dockhand and Mealie. When I log out of those, they take me back to their own login screen where clicking login will…
I've been integrating Authentik OIDC SSO with my self-hosted services and am frustrated by the logout behavior of some services. Specifically, Dockhand and Mealie. When I log out of those, they take me back to their own login screen where clicking login will automatically log me back in without prompting for credentials. I understand that this is because my Authentik session is still active. However, other apps such as Portainer will take me to an Authentik logout page where I can switch users or fully log out if desired. Dockhand and Mealie don't use or allow setting a logout URL and will never follow the Authentik invalidation flow. Some of my services are accessible to friends with their own Authentik accounts. If, for example, someone logged in to Mealie on a shared computer and then logged out, someone could come in behind them and access their account. This seems fundamentally flawed. I would not expect users to have to know and remember to navigate to Authentik directly and log out a second time. Am I missing something here? Is this just the result of half-baked OIDC implementations? How does everyone else deal with this? What alternatives are there?
Collected discussion
Not used
Expand the replies to this comment to learn how AI was used in this post/project.
I swear authentik has too many token and session lifetime settings. Cant figure out where to set this properly...
Baffled as to why this downvoted.
Because it’s copypasta straight from AI and this sub hates AI
Will do, thanks.
That is a good idea and something I actually tried at one point. Long story short is that I couldn't get it to work, but that could have just been me.
That sounds like the best potential solution so far. I'll see if I can find anything in Authentik. I've also considered switching to Pocket ID just for simplicity.
Pocket ID has an option you can set for each OIDC client to require re-authentication each time. I would imagine Authentik might have a similar thing?
Now that's an idea Edit: I quickly tried this out with Nextcloud and NPM as a reverse proxy: https://pastecode.io/s/rh52i9m2 This will delete your nextcloud cookies (Not sure if all of them have to be deleted) and then redirects from nextcloud's /apps/user_oidc/sls path to nextcloud's session ending URL. Seems to work pretty well so far.
yeah, you're not missing anything. the app is ending its own session, not the Authentik session. for shared devices I treat those apps as unsafe unless I can do one of two things: send /logout to Authentik's OIDC end_session_endpoint and clear the app cookie, or force reauth on that client with prompt=login / max_age=0 if the app supports extra auth params. short IdP sessions are a workaround, but they don't really fix the shared-computer case.
Potential idea: Make it so that your reverse proxy rewrites the app url to the authentik logout url. I've thought about doing this before but I haven't needed it yet.
please throw a feature request https://github.com/Finsys/dockhand. We'll fix that or at least make it configurable.
This is just how OAuth works sadly. We also have frustrations at my workplace and did the same as some other user suggested, set session times to be quite short so that a logout is pretty “close” to being a real logout
So many apps don't implement backchannel logouts. Big problem of oauth.
It sounds like some of your apps trigger Single Log Out (SLO) and some don’t: https://docs.goauthentik.io/add-secure-apps/providers/single-logout/
It's half baked OIDC and yes it's exhausting I kinda deal with it by not providing others access except to a select few services. To reliably logout you need to logout twice basically. Makes me wonder if I could vibe code a logout procedure that logs out of both services...
Expand the replies to this comment to learn how AI was used in this post/project.
This comment was deleted.
This comment was deleted.