providers/oauth: post_logout_redirect_uri support by PeshekDotDev · Pull Request #20011 · goauthentik/authentik

PeshekDotDev · 2026-02-04T09:33:35Z

Details

This adds proper support for post_logout_redirect_uri with oidc logouts while largely improving the way we interact with RP's during rp-initiated logout. With this, we will:

Validate the post_logout_redirect_uri
Send a logout notification back to the rp via frontchannel or backchannel if properly configured on the provider
Delete the access token for the provider
Redirect you to the post_logout_redirect_uri location

closes #10430
closes #19201

Checklist

Local tests pass (ak test authentik/)
The code has been formatted (make lint-fix)

If an API change has been made

The API schema has been updated (make gen-build)

If changes to the frontend have been made

The code has been formatted (make web)

If applicable

The documentation has been updated
The documentation has been formatted (make docs)

netlify · 2026-02-04T09:34:44Z

✅ Deploy Preview for authentik-storybook ready!

Name	Link
🔨 Latest commit	`9f1fbfe`
🔍 Latest deploy log	https://app.netlify.com/projects/authentik-storybook/deploys/69b37dfcd7d59000088860cf
😎 Deploy Preview	https://deploy-preview-20011--authentik-storybook.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

netlify · 2026-02-04T09:35:01Z

✅ Deploy Preview for authentik-docs ready!

Name	Link
🔨 Latest commit	`149e05a`
🔍 Latest deploy log	https://app.netlify.com/projects/authentik-docs/deploys/699d421384545a0008d83d0d
😎 Deploy Preview	https://deploy-preview-20011--authentik-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

netlify · 2026-02-04T09:35:03Z

✅ Deploy Preview for authentik-integrations ready!

Name	Link
🔨 Latest commit	`0535430`
🔍 Latest deploy log	https://app.netlify.com/projects/authentik-integrations/deploys/699d420b9a2e6c0008f6528e
😎 Deploy Preview	https://deploy-preview-20011--authentik-integrations.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

codecov · 2026-02-04T09:47:06Z

Codecov Report

❌ Patch coverage is 77.72021% with 43 lines in your changes missing coverage. Please review.
✅ Project coverage is 93.42%. Comparing base (7d3aca9) to head (9f1fbfe).
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
authentik/flows/stage.py	25.00%	18 Missing ⚠️
authentik/providers/oauth2/utils.py	13.33%	13 Missing ⚠️
authentik/providers/oauth2/views/end_session.py	84.00%	8 Missing ⚠️
authentik/providers/oauth2/signals.py	33.33%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #20011      +/-   ##
==========================================
- Coverage   93.45%   93.42%   -0.04%     
==========================================
  Files         991      992       +1     
  Lines       55948    56112     +164     
==========================================
+ Hits        52285    52420     +135     
- Misses       3663     3692      +29

Flag	Coverage Δ
conformance	`37.45% <18.65%> (-0.07%)`	⬇️
e2e	`42.98% <27.97%> (-0.06%)`	⬇️
integration	`22.22% <9.84%> (-0.05%)`	⬇️
unit	`91.60% <76.68%> (-0.01%)`	⬇️
unit-migrate	`91.69% <76.68%> (-0.01%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

github-actions · 2026-02-04T10:13:59Z

authentik PR Installation instructions

Instructions for docker-compose

Add the following block to your .env file:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-9f1fbfec7a94175d4a3a159220b75ce3341d83c6
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

Afterwards, run the upgrade commands from the latest release notes.

Instructions for Kubernetes

Add the following block to your values.yml file:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
    image:
        repository: ghcr.io/goauthentik/dev-server
        tag: gh-9f1fbfec7a94175d4a3a159220b75ce3341d83c6

Afterwards, run the upgrade commands from the latest release notes.

authentik/providers/oauth2/models.py

authentik/providers/oauth2/signals.py

authentik/providers/oauth2/utils.py

web/src/admin/providers/oauth2/OAuth2ProviderFormForm.ts

authentik/providers/oauth2/views/end_session.py

authentik/providers/oauth2/signals.py

Co-authored-by: Jens L. <jens@goauthentik.io> Signed-off-by: Connor Peshek <connor@connorpeshek.me>

mohammad-rj · 2026-03-17T19:27:50Z

We've been struggling with this for a while — post_logout_redirect_uri was completely ignored after RP-Initiated Logout, causing Authentik to fall back to the default authentication flow instead of redirecting back to the application.

After applying this patch via volume mount on 2026.2.0, the full logout flow finally works as expected:

User logs out of Gitea
nginx relays to Authentik's end-session endpoint with post_logout_redirect_uri
Authentik clears the session (UserLogoutStage) and redirects back to Gitea's login page
Next login requires full re-authentication — no silent auto-approve

One thing worth noting: the patch introduces RedirectURIType.LOGOUT to distinguish logout redirect URIs from authorization ones. Existing redirect_uris entries default to authorization type, so any post_logout_redirect_uri you want to allow must be explicitly set to logout type. This isn't documented anywhere yet — would be good to call it out in the release notes or admin UI.

Thanks for pushing this forward. This is a real gap that affects anyone using RP-Initiated Logout with OIDC clients.

PeshekDotDev added 4 commits February 4, 2026 00:27

oauth2/providers: add post logout redirect uri to providers

bdd0760

properly handle post_logout_redirect_uri and frontchannel message to rp

cd97040

add backchannel support

d9267ac

move logout url logic

fbaef25

PeshekDotDev self-assigned this Feb 4, 2026

PeshekDotDev requested a review from a team as a code owner February 4, 2026 09:33

PeshekDotDev added this to authentik Core Feb 4, 2026

PeshekDotDev requested a review from a team as a code owner February 4, 2026 09:33

github-project-automation bot moved this to Todo in authentik Core Feb 4, 2026

PeshekDotDev added 2 commits February 4, 2026 03:39

hoist imports

40370cf

Merge branch 'main' into oidc-logout-current

868ff14

PeshekDotDev mentioned this pull request Feb 4, 2026

Setting next or post_logout_redirect_uri properly? #10430

Open

hanlde forbidden_uri_schemes on post_logout_redirect_uri

5dd3272

PeshekDotDev moved this from Todo to Needs review in authentik Core Feb 5, 2026

BeryJu changed the title ~~OIDC post_logout_redirect_uri support~~ providers/oauth: post_logout_redirect_uri support Feb 5, 2026

BeryJu reviewed Feb 5, 2026

View reviewed changes

PeshekDotDev moved this from Needs review to In review in authentik Core Feb 6, 2026

PeshekDotDev added 4 commits February 6, 2026 22:00

merge post_logout with redirect_uri

b1f0a02

update hardcoded values

f7de31a

change to authorization and logout

394d76d

update words

099bf18

BeryJu reviewed Feb 23, 2026

View reviewed changes

authentik/providers/oauth2/views/end_session.py Outdated Show resolved Hide resolved

BeryJu reviewed Feb 23, 2026

View reviewed changes

authentik/providers/oauth2/signals.py Outdated Show resolved Hide resolved

BeryJu mentioned this pull request Feb 23, 2026

providers/oauth2: add jti claim #20484

Merged

Update authentik/providers/oauth2/views/end_session.py

0535430

Co-authored-by: Jens L. <jens@goauthentik.io> Signed-off-by: Connor Peshek <connor@connorpeshek.me>

PeshekDotDev and others added 3 commits February 24, 2026 00:15

Update authentik/providers/oauth2/signals.py

149e05a

Co-authored-by: Jens L. <jens@goauthentik.io> Signed-off-by: Connor Peshek <connor@connorpeshek.me>

fix merge conflict

e8e87e9

Merge branch 'main' into oidc-logout-current

9f1fbfe

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

providers/oauth: post_logout_redirect_uri support#20011

providers/oauth: post_logout_redirect_uri support#20011
PeshekDotDev wants to merge 15 commits intomainfrom
oidc-logout-current

PeshekDotDev commented Feb 4, 2026 •

edited

Loading

Uh oh!

netlify bot commented Feb 4, 2026 •

edited

Loading

Uh oh!

netlify bot commented Feb 4, 2026 •

edited

Loading

Uh oh!

netlify bot commented Feb 4, 2026 •

edited

Loading

Uh oh!

codecov bot commented Feb 4, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 4, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mohammad-rj commented Mar 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

PeshekDotDev commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Details

Checklist

Uh oh!

netlify bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for authentik-storybook ready!

Uh oh!

netlify bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for authentik-docs ready!

Uh oh!

netlify bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for authentik-integrations ready!

Uh oh!

codecov bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mohammad-rj commented Mar 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

PeshekDotDev commented Feb 4, 2026 •

edited

Loading

netlify bot commented Feb 4, 2026 •

edited

Loading

netlify bot commented Feb 4, 2026 •

edited

Loading

netlify bot commented Feb 4, 2026 •

edited

Loading

codecov bot commented Feb 4, 2026 •

edited

Loading

github-actions bot commented Feb 4, 2026 •

edited

Loading