fix(javascript-sdk): add logout redirect for pingone #443

cerebrl · 2024-05-08T03:10:31Z

JIRA Ticket

https://bugster.forgerock.org/jira/browse/SDKS-3211

Description

In order to support full, complete logout with OIDC on PingOne, including termination of session and removal of cookie in third-party context, logout redirect is required. This PR adds the redirect, but only in the condition a logoutRedirectUri is present in the logout options argument, or detection of PingOne endpoint of /as/signoff in endSession endpoint URL.

There's a "safety switch" that allows the deactivation of this logout redirect regardless of config or endpoint URL, and that's the function's options argument. If you pass in redirect: false, it will disable the redirect explicitly in the endSession method.

This is so, in the rare case we have an issue with endpoint naming schemes, there's a way to turn it off.

Type of Change

Please Delete options that are not relevant

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
This change requires a documentation update

How Has This Been Tested?

Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration

Definition of Done

Check all that apply

Documentation

Acceptance criteria met
Spell-check run
Peer reviewed
Proofread

nx-cloud · 2024-05-08T03:11:29Z

☁️ Nx Cloud Report

CI is running/has finished running commands for commit cb6977d. As they complete they will appear below. Click to see the status, the terminal output, and the build insights.

📂 See all runs for this CI Pipeline Execution

✅ Successfully ran 2 targets

Sent with 💌 from NxCloud.

ryanbas21 · 2024-05-08T14:47:34Z

packages/javascript-sdk/src/fr-user/index.ts

    } catch (error) {
      FRLogger.warn('Session logout was not successful');
    }
+
+    try {
+      await OAuth2Client.revokeToken(configOptions);


Is this specifically needed for the Ping redirect logout? I see we try/catch it so it won't break older flows, but i'm curious

We just moved this up. There's no code change for this method call.

cerebrl · 2024-05-08T22:19:07Z

e2e/autoscript-suites/src/utilities/setup-and-go.ts

@@ -89,7 +89,8 @@ export async function setupAndGo(
  });

  page.on('request', async (req) => {
-    const headers = await req.allHeaders();
+    const headers = await req.headers();


This removed the "pseudo-headers" and fixed the weird error with :authority.

cerebrl · 2024-05-08T22:56:17Z

packages/javascript-sdk/src/oauth2-client/index.ts

+   * @function endSession - call authorization server to end associated session
+   * @param options {LogoutOptions} - an extension of ConfigOptions, but with two additional props
+   * @param options.logoutRedirectUri {string} - the URL you want the AS to redirect to after signout
+   * @param options.redirect {boolean} - to explicitly deactivate redirect, pass `false`


I've moved the signoutUrl from the central config to the method options, keeping the central config clean.

we need the idToken for pingone signout and we also remove it in case we are not in a pingone signout. so we will store the idToken and pass it in, incase. default to empty string

redirect test case in autoscript

ryanbas21 · 2024-05-13T21:28:06Z

packages/javascript-sdk/src/config/index.ts

@@ -79,6 +79,7 @@ abstract class Config {
        'Missing well-known property. Use `Config.set` method if not using well-known endpoint.',
      );
    }
+    // @ts-expect-error safety against runtimes without typescript


I left this here because while typescript says we can not have this happen, i figured it was safer for us to keep this check in the code for runtime and using expect error just means we expect this line to error (because we are checking a property that can't exist on the interface)

cerebrl · 2024-05-14T19:25:44Z

e2e/autoscript-apps/src/authn-central-logout/callback.html

Is this being used? I don't see callback.html in the redirectUri config property.

cerebrl · 2024-05-14T20:14:08Z

e2e/autoscript-suites/src/suites/authn-central-logout.test.ts

+  await page.getByRole('link', { name: 'AuthN: Central Logout Ping' }).click();
+  const btn = page.getByRole('button', { name: 'Login' });
+  await btn.isVisible();
+  await btn.click({ clickCount: 1, delay: 300 });


Isn't this quite fragile? Shouldn't we use a wait until element is visible or some non-time-based check? I'm a bit worried that pure time based "sleeps" are not reliable.

we do wait for the button to be visible above, the delay was the only way for me to consistently click the button in the test. for some reason

cerebrl

LGTM

cerebrl requested a review from ryanbas21 May 8, 2024 03:10

github-actions bot added the sdk label May 8, 2024

cerebrl force-pushed the fix_central-logout-oidc branch from becd96e to b76dec3 Compare May 8, 2024 03:12

ryanbas21 reviewed May 8, 2024

View reviewed changes

github-actions bot added the root label May 8, 2024

cerebrl force-pushed the fix_central-logout-oidc branch from ed8d603 to 48145b9 Compare May 8, 2024 22:18

github-actions bot added the test label May 8, 2024

cerebrl commented May 8, 2024

View reviewed changes

cerebrl force-pushed the fix_central-logout-oidc branch from 48145b9 to 5302c68 Compare May 8, 2024 22:49

cerebrl commented May 8, 2024

View reviewed changes

fix(javascript-sdk): add logout redirect for pingone

561a2c9

cerebrl force-pushed the fix_central-logout-oidc branch from 5302c68 to 561a2c9 Compare May 9, 2024 00:43

refactor(javascript-sdk): keep-idtoken-in-closure

3330490

we need the idToken for pingone signout and we also remove it in case we are not in a pingone signout. so we will store the idToken and pass it in, incase. default to empty string

ryanbas21 force-pushed the fix_central-logout-oidc branch from 45d9a28 to 3330490 Compare May 9, 2024 21:54

test(javascript-sdk): update-test-for-redirect

cb6977d

redirect test case in autoscript

ryanbas21 reviewed May 13, 2024

View reviewed changes

cerebrl commented May 14, 2024

View reviewed changes

ryanbas21 approved these changes May 14, 2024

View reviewed changes

cerebrl merged commit 0f84909 into develop May 14, 2024
5 checks passed

cerebrl deleted the fix_central-logout-oidc branch May 14, 2024 21:15

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(javascript-sdk): add logout redirect for pingone #443

fix(javascript-sdk): add logout redirect for pingone #443

cerebrl commented May 8, 2024 •

edited

Loading

nx-cloud bot commented May 8, 2024 •

edited

Loading

ryanbas21 May 8, 2024

cerebrl May 8, 2024

cerebrl May 8, 2024

cerebrl May 8, 2024

ryanbas21 May 13, 2024

cerebrl May 14, 2024

cerebrl May 14, 2024

ryanbas21 May 14, 2024

cerebrl left a comment

fix(javascript-sdk): add logout redirect for pingone #443

fix(javascript-sdk): add logout redirect for pingone #443

Conversation

cerebrl commented May 8, 2024 • edited Loading

JIRA Ticket

Description

Type of Change

How Has This Been Tested?

Definition of Done

Documentation

nx-cloud bot commented May 8, 2024 • edited Loading

☁️ Nx Cloud Report

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cerebrl left a comment

Choose a reason for hiding this comment

cerebrl commented May 8, 2024 •

edited

Loading

nx-cloud bot commented May 8, 2024 •

edited

Loading