paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 42 Packages Projects Releases Wiki Activity

Merge pull request #33703 from backstage/feat/auth0-federated-logout

Browse Source 
feat(auth): support provider logout redirects, implement Auth0 federated logout
This commit is contained in:
Patrik Oldsberg
2026-04-01 15:27:27 +02:00
committed by GitHub
parent b9fec1bdc8 3bddf23896
commit 7bc057e8b6
14 changed files with 393 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.changeset/auth-node-logout-result.md
+5
View File
@@ -0,0 +1,5 @@
---
'@backstage/plugin-auth-node': patch
---
Added `OAuthAuthenticatorLogoutResult` type. The `logout` method on `OAuthAuthenticator` can now optionally return `{ logoutUrl }` to trigger a browser redirect after sign-out. This allows providers like Auth0 to clear their session cookies by redirecting to their logout endpoint.
.changeset/auth0-federated-logout.md
+5
View File
@@ -0,0 +1,5 @@
---
'@backstage/plugin-auth-backend-module-auth0-provider': minor
---
Added federated logout support. Set `federatedLogout: true` in the Auth0 provider config to clear both the Auth0 session and any upstream IdP session on sign-out. The authenticator returns a logout URL that redirects the browser to Auth0's `/v2/logout?federated` endpoint, ensuring users must fully re-authenticate after signing out.
.changeset/core-app-api-logout-redirect.md
+6
View File
@@ -0,0 +1,6 @@
---
'@backstage/core-app-api': patch
'@backstage/plugin-app': patch
---
The default auth implementation now checks for a `logoutUrl` in the logout response body. If the auth provider returns one (e.g. Auth0 federated logout), the browser is redirected to that URL to clear the provider's session cookies. This is backward compatible — providers that return an empty response are unaffected.