Trying to implement logout with apache openidc mod

[jsheena]

Hoping someone can help me out.
Are there good instructions to follow to get logout working with mod_auth_openidc and apache?

I’m trying to follow the solution here:

Users can't logout with mod auth openidc

Hello, we’ve using mod_auth_openidc on an current apache to secure a bunch of apps. I’ve followed and the Quickstart at My auth_openidc.conf looks like this: OIDCProviderMetadataURL https://[CLIENT_NAME].eu.auth0.com/.well-known/openid-configuration OIDCClientID [ID_PROVIDED_BY_AUTH0] OIDCClientSecret [SECRET_PROVIDED_BY_AUTH0] OIDCSessionInactivityTimeout 300 OIDCSessionMaxDuration 3600 OIDCCookieDomain subdomain.domain.tld OIDCProviderCheckSessionIFrame https://subdomain.domain.tld/o…

but even just calling the URL in step 1 isn’t clearing the cookies. Before trying to figure this out myself, I was wondering if anyone else has gotten this to work.

Thank you!

[jmangelo]

When you say:

step 1 isn’t clearing the cookies

are you being literal and checking that after the call to the logout endpoint the cookies are cleared on the client-side?

The reason I ask is that at this time the logout endpoint invalidates the session associated with the cookie that was sent as part of this request, but actually does not clear the cookie. This means the cookie may live on in the browser side and sent in a subsequent request, however, the session should be invalidated so this is mostly an implementation detail.