Handling a parameter to logout flow

[Cantor, Scott]

> Now we're trying to add support for a "return"
> URL parameter, which can be used to indicate where to redirect the user
> after logout has completed (instead of showing our generic "you've
> logged out" page).  This is intended to work similarly to the SP's
> "return" parameter on its local logout endpoint.

As I've mentioned a few times, we have basically deprecated that kind of behavior, mainly because it makes single logout impossible, and also just out of a general principle that if the IdP is logging you out, the IdP is the one that should control the landing. It's also essentially an open redirector out of the IdP, which is obviously not great.

> We've found at least one avenue for making this work.  We added the
> following to system/flows/logout/logout-flow.xml:

I wouldn't have expected it to be that clean to get back, but at present there's no supported way to do it.

> My questions would be:
> 
> - Is this a reasonable approach?

Well, you can't ever modify a system file unless you're prepared to deal with it when upgrading.
 
> - Is there a 'best practice' for handling the redirect among (or beyond)
> the approaches I've considered?

I treated the idea itself as a bad one that we should not support directly. SAML logout also doesn't work that way, so that was another reason, to align the behavior.

> - Editing system/* makes me feel icky.  Is there a preferred way to
> modify or insert things into the flow without having to do this?

No, not unless a lot of work was done to facilitate it, as I did in a few cases. Compositing flows is very difficult and error prone.

> Should I be copying the logout-flows.xml into flows/ somewhere to override the
> system flow definition?

You can, but then you're just creating a flow definition full of beans that are themselves subject to change at any time. You can do it, but I can't guarantee it won't break. Given all the complaints about logout as delivered, it would be a decent bet that it will change.

> Are intercepts available in the logout flow (most of the docs seem to focus on authn flows)?

Not in that sense. I suspect with all the required refactoring of logout to deal with the fact that everybody wants it to work a totally different way, creating an interceptor point is probably going to happen though. It's the only clean way for people to really get into the middle of things.

-- Scott