mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2025-09-08 19:27:18 +02:00

Files

Kevin Veen-Birkenbach 4ae3cee36c web-svc-logout: merge logout domains into CSP connect-src and refactor task flow

• Add tasks/01_core.yml to set applications[application_id].server.csp.whitelist['connect-src'] = LOGOUT_CONNECT_SRC_NEW.

• Switch tasks/main.yml to include 01_core.yml (run-once guard preserved).

• Update templates/env.j2 to emit LOGOUT_DOMAINS as a comma-separated list.

• Rework vars/main.yml: compute LOGOUT_DOMAINS, derive LOGOUT_ORIGINS with WEB_PROTOCOL, read connect-src via the get_app_conf filter, and merge/dedupe (unique).

Rationale: ensure CSP allows cross-domain logout requests for all configured services.

Conversation: https://chatgpt.com/share/68b5b07d-b208-800f-b6b2-f26934607c8a

2025-09-01 16:41:33 +02:00

config

replaced style-src-elem by style-src

2025-09-01 10:14:03 +02:00

filter_plugins

Restructured server config

2025-08-07 11:31:06 +02:00

README.md

web-svc-logout

This folder contains an Ansible role to deploy and configure the Universal Logout Service.

Description

This role sets up the universal logout proxy service, a Dockerized Python Flask container that coordinates logout requests across multiple OIDC-integrated applications. It also configures the necessary Nginx proxy snippets and environment variables to enable unified logout flows.

It solves the common challenge of logging a user out from all connected apps with a single action, especially in environments where apps live on multiple subdomains and use OIDC authentication.

Overview

Deploys the universal logout service container based on the official universal-logout GitHub repository.
Configures the logout domains dynamically based on application inventory and features using custom Ansible filters.
Provides an Nginx /logout proxy configuration snippet that handles CORS and forwards logout requests to the logout service.
Supplies a user-friendly logout conductor UI that requests logout on all configured domains and shows live status.
Designed to be used as the Front Channel Logout URL for Keycloak or other OpenID Connect providers, enabling a seamless, service-spanning logout experience.

Features

Automatic discovery of logout domains from applications with the features.logout flag enabled.
Centralized logout proxy that clears cookies and sessions across all configured subdomains.
Status page with live feedback on logout progress for each domain.
Built-in support for Docker Compose deployment and integration with the Infinito.Nexus ecosystem.
Includes security-conscious headers (CORS, CSP) for smooth cross-domain logout operations.

Further Resources

This role is licensed under the Infinito.Nexus NonCommercial License.