hcldan opened a new issue, #13750: URL: https://github.com/apache/apisix/issues/13750
### Current Behavior I understand that the openid-connect plugin does not have support for back-channel logout... our service behind the plugin does support this and knows when a user logs out or token is revoked. Right now we have requests going through a route configured with the plugin. Authentication happens normally, the user is redirected to the IDP and then the session is created with a cookie and everything works. The problem is after the user logs out by other means. Our backend server gets notified of the logout and considers the users access token invalid. When a request happens again through the route with the plugin, we return a 401 from the backend server and the 401 is returned through the route instead of the openid-connect plugin trying to acquire a new token. This is noticeable when the user logs back in, the route is broken for them until the access token it had eventually expires. Or when the user logs in as someone else, the same thing happens. ### Expected Behavior We expect the openid-connect plugin to try to get a new access token if the token it has results in a 401 where it is being used. ### Error Logs _No response_ ### Steps to Reproduce 1. configure route with openid-connect plugin 2. log in user with credentials through route 3. invalidate the token through other means (re-log in, or log in as new user) 4. try to access through route again ### Environment apisix version 2.16.0 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
