[Feature]: Add logout URL for OIDC authentication

[hartimcwildfly]

When logging out in Flipt, the endpoint
PUT /auth/v1/self/expire is called which deletes the session and then the browser is redirecting to /#/login.
In some cases the session on the IdP needs to be destroyed as well.
This can be done by a front channel logout URL. So basically an URL which the user is forwarded to (instead of being forwarded to /#/login
Can you add this feature to the OIDC authentication?

[github-actions]

Issue Health Check: Well scoped

Type: Feature request

The issue requests adding a configurable front-channel logout URL to Flipt's OIDC authentication so that after session expiry, users can be redirected to an IdP logout endpoint rather than only the Flipt login page. It clearly describes the current behavior, desired outcome, and technical motivation.

Thanks — this issue looks well scoped and ready for the maintainers to evaluate.

Need help with Flipt? Support the project through GitHub Sponsors or learn about Flipt Pro.

[erka]

Hey @hartimcwildfly

Thank you for your request. We had a similar discussion #5913 about this before. Not all OIDC providers support this feature. Would you be okay if there is an extra configuration option to enable this?

[hartimcwildfly]

Thanks for your fast reaction. Sounds good! Would be fine for me.

[erka]

I have implemented RP-Initiated Logout and Back-Channel Logout. Front-Channel Logout is still on my list.

[hartimcwildfly]

Hi @erka thanks for this! Can you mention me or send me the link for the front-channel logout issue? So I am notified when it is available.

[erka]

Hey @hartimcwildfly. I've linked the Front-Channel Logout PR to this issue.