feat(oidc): support post_logout_redirect_uri in logout - #9608
Draft
zhaohuabing wants to merge 2 commits into
Draft
feat(oidc): support post_logout_redirect_uri in logout#9608zhaohuabing wants to merge 2 commits into
zhaohuabing wants to merge 2 commits into
Conversation
Picks up envoyproxy/envoy#45367, which adds the post_logout_redirect_uri field to the OAuth2 filter config. Also regenerates extensions.gen.go for the extension types added since the previous pin. Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
✅ Deploy Preview for cerulean-figolla-1f9435 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
zhaohuabing
marked this pull request as draft
July 29, 2026 09:01
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #9608 +/- ##
==========================================
- Coverage 75.73% 75.73% -0.01%
==========================================
Files 254 254
Lines 42110 42178 +68
==========================================
+ Hits 31892 31943 +51
- Misses 8073 8090 +17
Partials 2145 2145 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
zhaohuabing
force-pushed
the
oidc-post-logout-redirect-uri
branch
from
July 29, 2026 13:12
4e07fb5 to
549c833
Compare
Adds spec.oidc.postLogoutRedirect to SecurityPolicy, controlling the post_logout_redirect_uri parameter Envoy sends to the OIDC provider's end session endpoint during RP-Initiated Logout. Set uri to send a specific value, or disabled to omit the parameter entirely. Envoy previously hardcoded this parameter to <scheme>://<host>/, the root of the inbound request's host. Many providers require the post logout redirect URI to be registered for the client and reject the logout request otherwise, so that default made RP-Initiated Logout unusable for them. The uri accepts the %REQ(header)% command operator so one policy can serve several hosts. Other operators are rejected up front, because Envoy fails filter creation on an unknown operator and would NACK the xDS update rather than report the mistake on the policy. The uri/disabled exclusivity is re-checked after policy merge as well, since CEL only ever sees an individual policy and a StrategicMerge can leave both fields set. Fixes envoyproxy#7349 Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
zhaohuabing
force-pushed
the
oidc-post-logout-redirect-uri
branch
from
July 29, 2026 13:28
549c833 to
4eac001
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does:
Adds
spec.oidc.postLogoutRedirectto SecurityPolicy, exposing Envoy's new OAuth2post_logout_redirect_urisetting for OIDC RP-Initiated Logout:Envoy previously hardcoded this parameter to
<scheme>://<host>/, the root of the inbound request's host. Per RP-Initiated Logout the parameter is optional, but when supplied it must be pre-registered with the provider — and the ingress root generally is not, so providers reject the whole logout request.urilets operators point at a registered landing page;disabledcovers providers that reject any unregistered value, where the parameter itself has to go.Release Notes: Yes
Fixes #7349