Clarify logout routes, nginx configurations and terms in documentation

[ksaadDE]

Dear fellows,

I had trouble finding the right logout route that is needed for outline as parameter OIDC_LOGOUT_URI neither proposed proxy-auth-domain.foo.tld/akprox/sign_out (see #1113 (comment)) nor End Session | /application/o/<application slug>/end-session/ works (see https://docs.goauthentik.io/docs/providers/oauth2/). #2023 (comment) mentions the route /outpost.goauthentik.io/sign_out . All routes return 404 not found.

What works (for outline!) is OIDC_LOGOUT_URI=https://authentik.domain.tld/flows/-/default/invalidation/ but I think it invalidates the whole session on all apps. Not sure about this tho, it's not documented. There is discussion about that in #2023, however the outcome remains unclear.

Furthermore I tried to find out what "application slugs" are, but the documentation describes nothing except the fact that they exist!

My question and central point: Can we somehow clarify the terms and URLs? People should not waste time on that, especially because it is so essential.

I understand it is very hard to keep up the good work in the Software Dev Life Cycle and it is not easy to document properly, when you are with your mind within the inner-circle of the project. For us users, whether it is free or premium, we need the clarification on that.

I think we all are eager to help. Thank you in advance, lets discuss that!

[ksaadDE]

I tried to find issues related to this (might be more!):

• Proxy provider - Forward-auth (domain level) - how to logout? #1113
• Logging out from authentik should invalidate sessions of proxied applications #2023
• Sign out proxy app and then automatically the same with authentik  #3471

[rouke-broersma]

I use /end-session/ in my configurations and this works fine. I get redirected to Authentik when logging out in a connected application, and can then choose to log back in, log out of the specific application session or log out of Authentik completely.

Application slugs are the slug for the application you configured on the.. application. The field is literally called slug.

If you wish to find the correct url to use, go to the provider registered for the application. All valid uri's are listed on the overview page of the provider. Including logout url. There is no need to try to construct the url's manually based on a template you find in the docs. The provider overview simply lists whatever url's are valid for that provider.

[ksaadDE]

Thanks! So it's the /application/o/appname/end-session/ URL ? in the admin interface on route /if/admin/#/core/providers/ /E: leading to /if/session-end/appname/

The problem without the full invalidation of the Authentik session simply accessing the app again logs the user back in. So I will probably stick with a full session termination.

Application slugs are the slug for the application you configured on the.. application. The field is literally called slug.

Yes that's what I have found out as well, but what is a slug in this context? A field that is named like that does not say what the field does or where I can find it in the UI.

[rouke-broersma]

Thanks! So it's the /application/o/appname/end-session/ URL ? in the admin interface on route /if/admin/#/core/providers/ /E: leading to /if/session-end/appname/

/application/o/<app slug>/end-session/ but yes.

A slug in web context is a part of the url for a specific item such as the name of the provider/application. See: https://support.squarespace.com/hc/en-us/articles/205814578-URL-slugs

When you create the app, you give the app a slug. This is by default the app name but you can customize this as you wish. There's also a helptext available next to the slug field that specifies "slug: Internal application name use in URLs."

[ksaadDE]

Thank you. That makes sense!

Mozilla's Dev site describes it as:

A Slug is the unique identifying part of a web address, typically at the end of the URL. In the context of MDN, it is the portion of the URL following "/docs/".
https://developer.mozilla.org/en-US/docs/Glossary/Slug

Seemingly it's very prevalent in the NodeJS Community and in the News field as SEO optimization. I never heard of slugs before, only route (in all frameworks and apps). Ofc I've worked with key tags or titles in URL as well before. But I have never seen it called as a slug.

When you create the app, you give the app a slug. This is by default the app name but you can customize this as you wish.

Yes makes sense, I just tried to find the definition of Slug in the docs, but yea it was just a field in a request, nothing more. 👍 So the connect to the app name (or wtv is set up) was missing.

Maybe it's better to call it id, if it's just another (unique; albeit modifiable) identifier.

[rouke-broersma]

It should probably just be derived from the app name and/or accept the client ID tbh instead of being a user serviceable field.

[rwjack]

I'm not getting the whole discussion from the linked issue.

Is it, or is it not possible to do the following?

1. Log in to Authentik
2. Open app 1 (logs me in automatically)
3. Open app 2 (logs me in automatically)
4. Log out of authentik
5. Now I am logged out of both app 1 and 2

[slimshizn]

It is not possible as of today to do that. Logging out still is allowing users to stay logged in. Killing their session does not work to kick users off of apps either.