Support regular OIDC logout from the central dashboard about kubeflow HOT 2 OPEN

I don't have much understanding of ideally how the logout flow should work on OIDC, but am for sure in favor of any effort to untangle it from the AuthService.

@AndersBennedsgaard do you have enough expertise to describe a numbered list of steps of how the logic should work in this case?

from kubeflow.

Sorry, no, I am definitely not an expert in this field. But having read the KeyCloak documentation on it it sounds like RP-Initiated Logout is the solution we want. It sounds like when the user clicks the "Log out" button you just redirect the browser to the logout URL, and the authentication backend handles the rest of the flow, which would be very simple to implement in the central dashboard.

If we want to be backwards compatible with the current functionality, we could add another environment variable LOGOUT_URL_REDIRECT which takes over the logout flow. Or we could add a --force-logout-redirect flag, which would make the dashboard do a redirect instead of a POST to the regular LOGOUT_URL.

from kubeflow.