SURE-3572

Research Status

Rancher processes UI logout requests in pkg/auth/tokens.

The existing code removes the relevant cookies from the browser and deletes the Rancher Token
resource associated with the current user.

This part has to be expanded to perform the SAML logout as well.

It is not possible to directly call into the pkg/auth/providers packages, as these use the tokens
package themselves, leading to an import loop.

This can be solved by extending the tokens package with a global callback invoked during logout
processing, if set.

Setting the callback to a suitable function during auth provider setup means that this function has
access to the auth/provider functionality while hiding this fact from the token manager.

The logout workflow is like the SSO a back and forth between the various components, i.e. Rancher,
IdP, and Browser.

It was attempted to avoid the latter by directly fetching the logout redirect url from within
Rancher.

This failed with KeyCloak (the IdP used for testing) returning an unknown error. The KC log
indicated a missing KEYCLOAK_IDENTITY cookie. I.e. this was likely an auth failure before auth could
even be checked. Inspection of the browser cookie management found such a cookie for the local KC
instance.

And with a proper redirect through the browser this kind of cookie should then be picked up and
properly auth the request.

Today this was tried, i.e. the code for the callback rewritten to have access to the initial logout
request and pending response structures and initiating a redirect in the response.

This also failed, to the point that KC did not even record any logout request, something which
happened for the direct fetch trialed before.

At this point I suspect that the Rancher UI fails to properly handle the redirect request we
return. It seems to ignore the result from its own logout request and simply continue on to showing
the main Rancher login and welcome form.

If that is true it means that the extended logout will require UI changes too.

Although it is not known to me yet where such changes have to happen.

This requires research into the UI code.

@gaktive can we get someone from your team to assist on Andreas research here?

I've added a comments to the JIRA issue. We might need to step back and plan this a bit more

Related UI ticket: rancher/dashboard#10941