fix: provider logout redirect and robust direct admin action routing

Author: bjoernch

plugins/universal_oidc_mail_sso/lib/OidcClient.php

@@ -126,6 +126,27 @@ public function fetchUserinfo(array $discovery, string $accessToken): array
         ]);
     }
 
+    public function buildEndSessionUrl(array $discovery, string $idTokenHint, string $postLogoutRedirectUri = ''): string
+    {
+        $endpoint = (string) ($discovery['end_session_endpoint'] ?? '');
+        if ($endpoint === '') {
+            return '';
+        }
+
+        $params = [
+            'id_token_hint' => $idTokenHint,
+        ];
+
+        if ($postLogoutRedirectUri !== '') {
+            $params['post_logout_redirect_uri'] = $postLogoutRedirectUri;
+            if (!empty($this->config['client_id'])) {
+                $params['client_id'] = (string) $this->config['client_id'];
+            }
+        }
+
+        return $endpoint . '?' . http_build_query($params, '', '&', PHP_QUERY_RFC3986);
+    }
+
     private function httpJson(string $method, string $url, array $options = []): array
     {
         $body = $this->http($method, $url, $options);

plugins/universal_oidc_mail_sso/universal_oidc_mail_sso.php

@@ -13,14 +13,15 @@
 
 class universal_oidc_mail_sso extends rcube_plugin
 {
-    public $task = 'login|mail|settings';
+    public $task = 'login|mail|settings|logout';
 
     private const SESSION_OIDC_SUB = 'universal_oidc_mail_sso_oidc_sub';
     private const SESSION_OIDC_EMAIL = 'universal_oidc_mail_sso_oidc_email';
     private const SESSION_OIDC_NONCE = 'universal_oidc_mail_sso_oidc_nonce';
     private const SESSION_OIDC_STATE = 'universal_oidc_mail_sso_oidc_state';
     private const SESSION_OIDC_CODE_VERIFIER = 'universal_oidc_mail_sso_oidc_code_verifier';
     private const SESSION_OIDC_GROUPS = 'universal_oidc_mail_sso_oidc_groups';
+    private const SESSION_OIDC_ID_TOKEN = 'universal_oidc_mail_sso_id_token';
     private const SESSION_AUTLOGIN = 'universal_oidc_mail_sso_autologin';
     private const SESSION_SETUP_RATE = 'universal_oidc_mail_sso_setup_rate';
     private const PREF_OIDC_GROUPS = 'universal_oidc_mail_sso_groups';
@@ -39,6 +40,7 @@ class universal_oidc_mail_sso extends rcube_plugin
     private ?Crypto $crypto = null;
     private ?string $cryptoInitError = null;
     private ?array $policyCache = null;
+    private ?string $pendingLogoutIdToken = null;
 
     public function init(): void
     {
@@ -57,6 +59,7 @@ public function init(): void
         $this->add_hook('authenticate', [$this, 'authenticate']);
         $this->add_hook('storage_connect', [$this, 'storageConnect']);
         $this->add_hook('smtp_connect', [$this, 'smtpConnect']);
+        $this->add_hook('logout_after', [$this, 'logoutAfter']);
 
         $this->register_action(self::ACTION_LOGIN, [$this, 'actionLogin']);
         $this->register_action(self::ACTION_CALLBACK, [$this, 'actionCallback']);
@@ -72,22 +75,43 @@ public function init(): void
     public function startup(array $args): array
     {
         $action = rcube_utils::get_input_value('_action', rcube_utils::INPUT_GPC);
+        $adminActions = [
+            self::ACTION_ADMIN,
+            self::ACTION_ADMIN_SAVE_POLICY,
+            self::ACTION_ADMIN_DELETE_USER,
+            self::ACTION_ADMIN_SET_USER_STATUS,
+        ];
+
+        // Ensure direct admin action links always route to a valid auth flow.
+        if (is_string($action) && in_array($action, $adminActions, true)) {
+            if (empty($_SESSION['user_id'])) {
+                $this->redirectTo($this->urlForAction(self::ACTION_LOGIN));
+            }
+
+            if ($this->rc->task !== 'settings') {
+                $this->redirectTo($this->rc->url(['task' => 'settings', 'action' => $action]));
+            }
+        }
 
         // If admin plugin endpoints are accessed directly without a Roundcube
         // session, start OIDC login flow instead of failing with access errors.
         if ($this->rc->task === 'settings'
             && is_string($action)
-            && in_array($action, [
-                self::ACTION_ADMIN,
-                self::ACTION_ADMIN_SAVE_POLICY,
-                self::ACTION_ADMIN_DELETE_USER,
-                self::ACTION_ADMIN_SET_USER_STATUS,
-            ], true)
+            && in_array($action, $adminActions, true)
             && empty($_SESSION['user_id'])
         ) {
             $this->redirectTo($this->urlForAction(self::ACTION_LOGIN));
         }
 
+        // Capture id_token on logout request. We'll redirect to OIDC
+        // end_session_endpoint in logoutAfter(), after local logout completes.
+        if ($this->rc->task === 'logout') {
+            $idToken = $_SESSION[self::SESSION_OIDC_ID_TOKEN] ?? null;
+            if (is_string($idToken) && $idToken !== '') {
+                $this->pendingLogoutIdToken = $idToken;
+            }
+        }
+
         if ($this->rc->task !== 'login' || !empty($_SESSION['user_id'])) {
             return $args;
         }
@@ -319,6 +343,7 @@ public function actionCallback(): void
         $_SESSION[self::SESSION_OIDC_SUB] = $sub;
         $_SESSION[self::SESSION_OIDC_EMAIL] = $email;
         $_SESSION[self::SESSION_OIDC_GROUPS] = $groups;
+        $_SESSION[self::SESSION_OIDC_ID_TOKEN] = (string) ($token['id_token'] ?? '');
 
         $existingIdentity = $this->storage->getIdentityBySub($sub);
         if (!empty($existingIdentity['is_disabled'])) {
@@ -345,6 +370,27 @@ public function actionCallback(): void
         $this->redirectTo($this->urlForAction(self::ACTION_AUTOLOGIN));
     }
 
+    public function logoutAfter(array $args): array
+    {
+        if ($this->pendingLogoutIdToken === null || $this->pendingLogoutIdToken === '') {
+            return $args;
+        }
+
+        try {
+            $oidc = $this->oidcClient();
+            $discovery = $oidc->discover();
+            $postLogoutRedirect = (string) $this->cfg('post_logout_redirect_uri', $this->externalBaseUrl() . '/');
+            $url = $oidc->buildEndSessionUrl($discovery, $this->pendingLogoutIdToken, $postLogoutRedirect);
+            if ($url !== '') {
+                $this->redirectTo($url);
+            }
+        } catch (Throwable $e) {
+            $this->log('oidc_logout_redirect_failed', ['err' => $e->getMessage()]);
+        }
+
+        return $args;
+    }
+
     public function actionAutologin(): void
     {
         $oidcSub = $_SESSION[self::SESSION_OIDC_SUB] ?? null;