pas.plugins.oidc 2.0.0b3__tar.gz → 2.0.0b4__tar.gz

{pas.plugins.oidc-2.0.0b3 → pas_plugins_oidc-2.0.0b4}/CHANGES.md

@@ -9,12 +9,20 @@
 
 <!-- towncrier release notes start -->
 
+## 2.0.0b4 (2025-02-28)
+
+
+### New features:
+
+- Add backchannel logout implementation for classic ui session @mamico [#67](https://github.com/collective/pas.plugins.oidc/issues/67)
+
 ## 2.0.0b3 (2025-02-03)
 
 
 ### New features:
 
 - Register the adapter as needed by the @login endpoint present in plone.restapi @erral [#47](https://github.com/collective/pas.plugins.oidc/issues/47)
+- Changes to make compatible with OAM (Oracle Access Manager) @djay [#65](https://github.com/collective/pas.plugins.oidc/pull/64)
 
 
 ### Internal:

{pas.plugins.oidc-2.0.0b3 → pas_plugins_oidc-2.0.0b4}/Makefile

@@ -35,6 +35,7 @@ ifeq ($(PYTHON_VERSION_OK),0)
 endif
 
 all: build
+build: install
 
 # Add the following 'help' target to your Makefile
 # And add help text after each target name starting with '\#\#'

{pas.plugins.oidc-2.0.0b3 → pas_plugins_oidc-2.0.0b4}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.2
 Name: pas.plugins.oidc
-Version: 2.0.0b3
+Version: 2.0.0b4
 Summary: OIDC support for Plone sites
 Home-page: https://github.com/collective/pas.plugins.oidc
 Author: mamico
@@ -53,6 +53,19 @@ Requires-Dist: zest.releaser[recommended]; extra == "test"
 Requires-Dist: zestreleaser.towncrier; extra == "test"
 Requires-Dist: pytest-mock; extra == "test"
 Requires-Dist: requests-mock; extra == "test"
+Dynamic: author
+Dynamic: author-email
+Dynamic: classifier
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: keywords
+Dynamic: license
+Dynamic: project-url
+Dynamic: provides-extra
+Dynamic: requires-dist
+Dynamic: requires-python
+Dynamic: summary
 
 
 <div align="center"><img alt="pas.plugins.oidc logo" src="https://raw.githubusercontent.com/collective/pas.plugins.oidc/main/docs/icon.png" width="70" /></div>
@@ -270,6 +283,19 @@ Currently, the Plone logout form is unchanged.
 Instead, for testing go to the logout page of the plugin: http://localhost:8080/Plone/acl_users/oidc/logout,
 this will take you to Keycloak to logout, and then return to the post-logout redirect URL.
 
+#### Backchannel SLO (experimental)
+
+OIDC Backchannel Logout is a server-to-server mechanism where the IdP notifies RPs via an HTTP POST request to terminate user sessions upon logout, ensuring secure and seamless Single Logout (SLO) without relying on the user's browser.
+See the specification [OpenID Connect Back-Channel Logout 1.0](https://openid.net/specs/openid-connect-backchannel-1_0.html).
+
+Current backchannel logout implementation, in this product, utilizes functionality introduced in plone.session >= 4.0.0 (Plone 6 and later) for server-side session invalidation (see plone.session PR [plone.session#26](https://github.com/plone/plone.session/pull/26)), and, at the moment, applies only to Plone Classic UI.
+
+To enable this functionality:
+
+1. Navigate to `.../acl_users/session/manage_secret` and enable the `Enable per-user keyring` option.
+
+2. Configure the OpenID Provider (e.g., Keycloak) to use the backchannel logout endpoint with the url: `.../acl_users/oidc/backchannel-logout`
+
 ## Technical Decisions
 
 ### Usage of sessions in the login process
@@ -411,12 +437,20 @@ The project is licensed under the GPLv2.
 
 <!-- towncrier release notes start -->
 
+## 2.0.0b4 (2025-02-28)
+
+
+### New features:
+
+- Add backchannel logout implementation for classic ui session @mamico [#67](https://github.com/collective/pas.plugins.oidc/issues/67)
+
 ## 2.0.0b3 (2025-02-03)
 
 
 ### New features:
 
 - Register the adapter as needed by the @login endpoint present in plone.restapi @erral [#47](https://github.com/collective/pas.plugins.oidc/issues/47)
+- Changes to make compatible with OAM (Oracle Access Manager) @djay [#65](https://github.com/collective/pas.plugins.oidc/pull/64)
 
 
 ### Internal:

{pas.plugins.oidc-2.0.0b3 → pas_plugins_oidc-2.0.0b4}/README.md

@@ -213,6 +213,19 @@ Currently, the Plone logout form is unchanged.
 Instead, for testing go to the logout page of the plugin: http://localhost:8080/Plone/acl_users/oidc/logout,
 this will take you to Keycloak to logout, and then return to the post-logout redirect URL.
 
+#### Backchannel SLO (experimental)
+
+OIDC Backchannel Logout is a server-to-server mechanism where the IdP notifies RPs via an HTTP POST request to terminate user sessions upon logout, ensuring secure and seamless Single Logout (SLO) without relying on the user's browser.
+See the specification [OpenID Connect Back-Channel Logout 1.0](https://openid.net/specs/openid-connect-backchannel-1_0.html).
+
+Current backchannel logout implementation, in this product, utilizes functionality introduced in plone.session >= 4.0.0 (Plone 6 and later) for server-side session invalidation (see plone.session PR [plone.session#26](https://github.com/plone/plone.session/pull/26)), and, at the moment, applies only to Plone Classic UI.
+
+To enable this functionality:
+
+1. Navigate to `.../acl_users/session/manage_secret` and enable the `Enable per-user keyring` option.
+
+2. Configure the OpenID Provider (e.g., Keycloak) to use the backchannel logout endpoint with the url: `.../acl_users/oidc/backchannel-logout`
+
 ## Technical Decisions
 
 ### Usage of sessions in the login process

{pas.plugins.oidc-2.0.0b3 → pas_plugins_oidc-2.0.0b4}/pyproject.toml

@@ -123,7 +123,7 @@ Zope = [
 ]
 python-dateutil = ['dateutil']
 ignore-packages = ['plone.restapi', 'plone.volto', 'zestreleaser.towncrier', 'zest.releaser', 'pytest', 'pytest-cov', 'pytest-plone', 'pytest-docker', 'pytest-vcr', 'pytest-mock', 'zope.pytestlayer', 'requests-mock', 'vcrpy']
-Plone = ['Products.CMFPlone', 'Products.CMFCore', 'Products.GenericSetup', 'Products.PluggableAuthService', 'Products.PlonePAS']
+Plone = ['Products.CMFPlone', 'Products.CMFCore', 'Products.GenericSetup', 'Products.PluggableAuthService', 'Products.PlonePAS', 'plone.keyring']
 
 ##
 # Add extra configuration options in .meta.toml:

{pas.plugins.oidc-2.0.0b3 → pas_plugins_oidc-2.0.0b4}/requirements.txt

@@ -1,2 +1,2 @@
 -c constraints.txt
--e ".[test]"
+-e .[test]

{pas.plugins.oidc-2.0.0b3 → pas_plugins_oidc-2.0.0b4}/setup.py

@@ -14,7 +14,7 @@ long_description = f"""
 
 setup(
     name="pas.plugins.oidc",
-    version="2.0.0b3",
+    version="2.0.0b4",
     description="OIDC support for Plone sites",
     long_description=long_description,
     long_description_content_type="text/markdown",

{pas.plugins.oidc-2.0.0b3 → pas_plugins_oidc-2.0.0b4}/src/pas/plugins/oidc/browser/configure.zcml

@@ -37,4 +37,12 @@
       layer="pas.plugins.oidc.interfaces.IPasPluginsOidcLayer"
       />
 
+  <browser:page
+      name="backchannel-logout"
+      for="pas.plugins.oidc.plugins.IOIDCPlugin"
+      class=".view.BackChannelLogoutView"
+      permission="zope2.View"
+      layer="pas.plugins.oidc.interfaces.IPasPluginsOidcLayer"
+      />
+
 </configure>

{pas.plugins.oidc-2.0.0b3 → pas_plugins_oidc-2.0.0b4}/src/pas/plugins/oidc/browser/view.py

@@ -1,3 +1,4 @@
+from oic.oic.message import BackChannelLogoutRequest
 from oic.oic.message import EndSessionRequest
 from oic.oic.message import IdToken
 from pas.plugins.oidc import _
@@ -6,9 +7,11 @@ from pas.plugins.oidc import utils
 from pas.plugins.oidc.plugins import OAuth2ConnectionException
 from pas.plugins.oidc.session import Session
 from plone import api
+from plone.keyring.interfaces import IKeyManager
 from Products.Five.browser import BrowserView
 from urllib.parse import quote
 from zExceptions import Unauthorized
+from zope.component import getUtility
 
 
 class RequireLoginView(BrowserView):
@@ -143,3 +146,32 @@ class CallbackView(BrowserView):
             self.request.response.redirect(return_url)
         else:
             raise Unauthorized()
+
+
+class BackChannelLogoutView(BrowserView):
+    def __call__(self):
+        if not self.request.method == "POST" or not self.request.get("logout_token"):
+            raise Unauthorized()
+        logout_request = BackChannelLogoutRequest(
+            logout_token=self.request.get("logout_token")
+        )
+        client = self.context.get_oauth2_client()
+        if logout_request.verify(
+            aud=client.client_id, iss=client.issuer, keyjar=client.keyjar
+        ):
+            userid = logout_request.to_dict()["logout_token"]["sub"]
+            session = api.portal.get_tool("acl_users").session
+            if session.per_user_keyring:
+                secret_key = session._getSecretKey(userid)
+                manager = getUtility(IKeyManager)
+                if manager[secret_key]:
+                    manager.clear(ring=secret_key)
+                    manager.rotate(ring=secret_key)
+            else:
+                logger.error(
+                    "For the backchannel logout, the session PAS needs to be configured with 'per user keyring'."
+                )
+            return ""
+        else:
+            logger.error("invalid backchannel logout request")
+            raise Unauthorized()

{pas.plugins.oidc-2.0.0b3 → pas_plugins_oidc-2.0.0b4}/src/pas.plugins.oidc.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.2
 Name: pas.plugins.oidc
-Version: 2.0.0b3
+Version: 2.0.0b4
 Summary: OIDC support for Plone sites
 Home-page: https://github.com/collective/pas.plugins.oidc
 Author: mamico
@@ -53,6 +53,19 @@ Requires-Dist: zest.releaser[recommended]; extra == "test"
 Requires-Dist: zestreleaser.towncrier; extra == "test"
 Requires-Dist: pytest-mock; extra == "test"
 Requires-Dist: requests-mock; extra == "test"
+Dynamic: author
+Dynamic: author-email
+Dynamic: classifier
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: keywords
+Dynamic: license
+Dynamic: project-url
+Dynamic: provides-extra
+Dynamic: requires-dist
+Dynamic: requires-python
+Dynamic: summary
 
 
 <div align="center"><img alt="pas.plugins.oidc logo" src="https://raw.githubusercontent.com/collective/pas.plugins.oidc/main/docs/icon.png" width="70" /></div>
@@ -270,6 +283,19 @@ Currently, the Plone logout form is unchanged.
 Instead, for testing go to the logout page of the plugin: http://localhost:8080/Plone/acl_users/oidc/logout,
 this will take you to Keycloak to logout, and then return to the post-logout redirect URL.
 
+#### Backchannel SLO (experimental)
+
+OIDC Backchannel Logout is a server-to-server mechanism where the IdP notifies RPs via an HTTP POST request to terminate user sessions upon logout, ensuring secure and seamless Single Logout (SLO) without relying on the user's browser.
+See the specification [OpenID Connect Back-Channel Logout 1.0](https://openid.net/specs/openid-connect-backchannel-1_0.html).
+
+Current backchannel logout implementation, in this product, utilizes functionality introduced in plone.session >= 4.0.0 (Plone 6 and later) for server-side session invalidation (see plone.session PR [plone.session#26](https://github.com/plone/plone.session/pull/26)), and, at the moment, applies only to Plone Classic UI.
+
+To enable this functionality:
+
+1. Navigate to `.../acl_users/session/manage_secret` and enable the `Enable per-user keyring` option.
+
+2. Configure the OpenID Provider (e.g., Keycloak) to use the backchannel logout endpoint with the url: `.../acl_users/oidc/backchannel-logout`
+
 ## Technical Decisions
 
 ### Usage of sessions in the login process
@@ -411,12 +437,20 @@ The project is licensed under the GPLv2.
 
 <!-- towncrier release notes start -->
 
+## 2.0.0b4 (2025-02-28)
+
+
+### New features:
+
+- Add backchannel logout implementation for classic ui session @mamico [#67](https://github.com/collective/pas.plugins.oidc/issues/67)
+
 ## 2.0.0b3 (2025-02-03)
 
 
 ### New features:
 
 - Register the adapter as needed by the @login endpoint present in plone.restapi @erral [#47](https://github.com/collective/pas.plugins.oidc/issues/47)
+- Changes to make compatible with OAM (Oracle Access Manager) @djay [#65](https://github.com/collective/pas.plugins.oidc/pull/64)
 
 
 ### Internal:

{pas.plugins.oidc-2.0.0b3 → pas_plugins_oidc-2.0.0b4}/src/pas.plugins.oidc.egg-info/SOURCES.txt

@@ -45,11 +45,8 @@ src/pas/plugins/oidc/controlpanel/serializer.py
 src/pas/plugins/oidc/locales/__init__.py
 src/pas/plugins/oidc/locales/pas.plugins.oidc.pot
 src/pas/plugins/oidc/locales/update.py
-src/pas/plugins/oidc/locales/de/LC_MESSAGES/pas.plugins.oidc.mo
 src/pas/plugins/oidc/locales/de/LC_MESSAGES/pas.plugins.oidc.po
-src/pas/plugins/oidc/locales/en/LC_MESSAGES/pas.plugins.oidc.mo
 src/pas/plugins/oidc/locales/en/LC_MESSAGES/pas.plugins.oidc.po
-src/pas/plugins/oidc/locales/es/LC_MESSAGES/pas.plugins.oidc.mo
 src/pas/plugins/oidc/locales/es/LC_MESSAGES/pas.plugins.oidc.po
 src/pas/plugins/oidc/profiles/default/browserlayer.xml
 src/pas/plugins/oidc/profiles/default/controlpanel.xml