Support OpenID Connect Back-Channel Logout 1.0 #572

Environment

• lua-resty-openidc version 1.9.1
• OpenID Connect provider: Keycloak (any OP that implements Back-Channel Logout 1.0)

Expected behaviour

When the OP POSTs a logout token to the RP's back-channel logout URI, the matching session stops being accepted on the next request.

Requested in #268 and #395. #321 and #330 were closed in June with a note that logout support should start from a fresh design against the current lua-resty-session API. lua-resty-session 4.2.0 now has a revocation denylist for cookie sessions and 1.9.1 already propagates its failures (#571), so this is that design. Depends on bungle/lua-resty-session#211 for revoke-by-key.

1. openidc.backchannel_logout(opts, session_opts): content handler for the logout URI. Reads logout_token from the POST body and validates it per Back-Channel Logout 1.0 section 2.6 with the existing discovery, JWKS and jwt_verify code: iss, aud, iat, events contains http://schemas.openid.net/event/backchannel-logout, sid or sub present, nonce absent, alg=none rejected, jti replay guard. On success it calls session.revoke() for sid:<iss>#<sid> or sub:<iss>#<sub> with TTL equal to the session absolute timeout. Responds 200, 400 or 503 per section 2.8 with Cache-Control: no-store.
2. In authenticate, after login, set the session's revocation keys from the id_token iss, sid and sub, so session:open() rejects a revoked session on the next request. sub-only tokens match only sessions authenticated before the token's iat.
3. No new options beyond the existing revocation and revocation_fail_mode session settings. Front-channel logout and server-side session storage are out of scope for the first cut.

Actual behaviour

No back-channel logout support. A session stays valid until its cookie or stored token expires, even after the OP has ended the user's session.

Minimized example

location /oidc/backchannel-logout {
    content_by_lua_block {
        require("resty.openidc").backchannel_logout(opts, session_opts)
    }
}

Configuration and NGINX server log files

Not applicable, feature proposal.