[Feature] [Platform] OpenID Logout Endpoints (#1906)

Author: ajanikow

CHANGELOG.md

@@ -19,6 +19,7 @@
 - (Feature) Optional LocalStorage CRD
 - (Bugfix) Fix Checksum Calculation
 - (Bugfix) Implement Missing Group Tolerations
+- (Feature) (Platform) OpenID Logout Endpoints
 
 ## [1.2.48](https://github.com/arangodb/kube-arangodb/tree/1.2.48) (2025-05-08)
 - (Maintenance) Extend Documentation

integrations/authentication/v1/implementation.go

@@ -40,6 +40,7 @@ import (
 	pbAuthenticationV1 "github.com/arangodb/kube-arangodb/integrations/authentication/v1/definition"
 	"github.com/arangodb/kube-arangodb/integrations/envoy/auth/v3/impl/auth_cookie"
 	pbSharedV1 "github.com/arangodb/kube-arangodb/integrations/shared/v1/definition"
+	platformAuthenticationApi "github.com/arangodb/kube-arangodb/pkg/apis/platform/v1alpha1/authentication"
 	"github.com/arangodb/kube-arangodb/pkg/util"
 	"github.com/arangodb/kube-arangodb/pkg/util/cache"
 	"github.com/arangodb/kube-arangodb/pkg/util/errors"
@@ -323,7 +324,7 @@ func (i *implementation) Logout(ctx context.Context, req *pbAuthenticationV1.Log
 
 		for _, l := range lines {
 			switch l.Name {
-			case auth_cookie.JWTAuthorizationCookieName:
+			case auth_cookie.JWTAuthorizationCookieName, platformAuthenticationApi.OpenIDJWTSessionID, platformAuthenticationApi.OpenIDJWTRedirect:
 				l.MaxAge = -1
 				if err := grpc.SetHeader(ctx, metadata.Pairs("Set-Cookie", l.String())); err != nil {
 					logger.Err(err).Warn("Unable to set the cookie")
@@ -334,13 +335,10 @@ func (i *implementation) Logout(ctx context.Context, req *pbAuthenticationV1.Log
 		}
 	}
 
-	location := "/"
 	if req.Location != nil {
-		location = req.GetLocation()
-	}
-
-	if err := grpc.SetHeader(ctx, metadata.Pairs("Location", location)); err != nil {
-		logger.Err(err).Warn("Unable to set the cookie")
+		if err := grpc.SetHeader(ctx, metadata.Pairs("Location", req.GetLocation())); err != nil {
+			logger.Err(err).Warn("Unable to set the cookie")
+		}
 	}
 
 	return &pbSharedV1.Empty{}, nil

integrations/config/v1/impl_darwin.go

@@ -1,7 +1,7 @@
 //
 // DISCLAIMER
 //
-// Copyright 2024 ArangoDB GmbH, Cologne, Germany
+// Copyright 2024-2025 ArangoDB GmbH, Cologne, Germany
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -24,7 +24,7 @@ import (
 	"fmt"
 	"os"
 	"path"
-	"strings"
+	goStrings "strings"
 	"syscall"
 	"time"
 
@@ -40,7 +40,7 @@ import (
 func (i *impl) fileDetails(module ModuleDefinition, file string, checksum bool) (*pbConfigV1.ConfigV1File, error) {
 	expectedPath := path.Clean(path.Join(module.Path, file))
 
-	if !strings.HasPrefix(expectedPath, fmt.Sprintf("%s/", module.Path)) {
+	if !goStrings.HasPrefix(expectedPath, fmt.Sprintf("%s/", module.Path)) {
 		return nil, status.Errorf(codes.InvalidArgument, "File name cannot be empty")
 	}
 
@@ -62,7 +62,7 @@ func (i *impl) fileDetails(module ModuleDefinition, file string, checksum bool)
 
 	var f pbConfigV1.ConfigV1File
 
-	f.Path = strings.TrimPrefix(expectedPath, fmt.Sprintf("%s/", module.Path))
+	f.Path = goStrings.TrimPrefix(expectedPath, fmt.Sprintf("%s/", module.Path))
 	f.Size = finfo.Size
 	f.Created = timestamppb.New(time.Unix(finfo.Ctimespec.Sec, finfo.Ctimespec.Nsec))
 	f.Updated = timestamppb.New(time.Unix(finfo.Mtimespec.Sec, finfo.Mtimespec.Nsec))