From 58b254f9cb923d5d0dfe53df4bca8a0f00bbcf0b Mon Sep 17 00:00:00 2001
From: Aaron Schif <aaronschif@gmail.com>
Date: Mon, 12 Jun 2023 03:22:46 -0500
Subject: Add OpenID Connect (#5351)

* Add OIDC

* Update documentation.

* Update apache conf adding IfModule

* Use IfDefine for OIDC in apache conf

* Fix non-oidc support

* Fix typing

* Use IfDefine to enable OIDC

* Add OIDC support to all dockerfiles

* Re add apache Require option

* Fixes and documentation

* A few more fixes

* A bit more doc

* Change type of environment variable

* Update readme

* Correct apache config for OIDC support.

* Fix README formatting

* Update oidc control path

* Fix oidc endpoint being cached

* A bit more review

* Simplify ExpiresActive

* Add session refresh and improve caching

* Allow more different setups

* A bit more documentation

* A bit more readme

---------

Co-authored-by: Aaron Schif <aschif@netdevgroup.com>
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
Co-authored-by: maTh <math-home@web.de>
---
 app/layout/aside_configure.phtml | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

(limited to 'app')

diff --git a/app/layout/aside_configure.phtml b/app/layout/aside_configure.phtml
index e179ef121..87fd27c59 100644
--- a/app/layout/aside_configure.phtml
+++ b/app/layout/aside_configure.phtml
@@ -1,3 +1,16 @@
+<?php
+function get_logout_url(): string {
+	if (($_SERVER['AUTH_TYPE'] ?? '') === 'openid-connect') {
+		$url_string = urlencode(Minz_Request::guessBaseUrl());
+		return './oidc/?logout=' . $url_string . '/';
+		# The trailing slash is necessary so that we don’t redirect to http://.
+		# https://bz.apache.org/bugzilla/show_bug.cgi?id=61355#c13
+	} else {
+		return _url('auth', 'logout') ?: '';
+	}
+}
+?>
+
 <nav class="nav nav-list aside" id="aside_feed">
 	<a class="toggle_aside" href="#close"><?= _i('close') ?></a>
 
@@ -9,7 +22,7 @@
 					<a href="<?= _url('user', 'profile') ?>"><?= _t('gen.menu.user_profile') ?></a>
 				</li>
 				<li class="item">
-					<a class="signout" href="<?= _url('auth', 'logout') ?>">
+					<a class="signout" href="<?= get_logout_url() ?>">
 						<?php
 						echo _t('gen.auth.logout'); ?> <?= _i('logout') ?></a>
 				</li>
-- 
cgit v1.2.3