OpenID Connect Back-Channel Logout (end Vikunja sessions when the provider session ends)

Feature Discussion
1

Problem

When a user signs out at the OpenID provider, or an admin ends their sessions there, Vikunja doesn’t notice. Its own session (refresh token) stays valid – up to 30 days with “remember me”, and in the mobile app as well. RP-initiated logout (logouturl / end_session_endpoint) already works nicely in the other direction, Vikunja → provider.

The typical case for us: a family member loses a phone. Ending all sessions in the identity provider (Keycloak) signs them out of every other app, but Vikunja has to be cleaned up separately in the user’s session list.

Proposal

Support OpenID Connect Back-Channel Logout 1.0, opt-in per provider:

  1. A new endpoint, e.g. POST /api/v1/auth/openid/{provider}/backchannel-logout, which accepts a logout_token (form field).
  2. Validate it like an ID token (signature via the provider’s JWKS, iss, aud, iat, the events claim, no nonce).
  3. Delete the matching Vikunja sessions: by sid if present (the provider’s session ID from the ID token, which Vikunja already stores for id_token_hint), otherwise all sessions of the user matched by sub.
  4. The admin enters this URL as the back-channel logout URL in the provider (Keycloak, Authentik, Authelia, Zitadel and others support it).

Access tokens would still run out on their own (service.jwtttlshort, 10 minutes by default), but no refresh would be possible after that.

Context

Vikunja 2.7.0, self-hosted for a family, sign-in via Keycloak (brokering to Stalwart). I checked the source only: sessions with refresh tokens and the stored OIDC ID token are in pkg/models/sessions.go, logout towards the provider in pkg/modules/auth/openid/logout.go; I found no back-channel logout on main and no existing topic here.

(Drafted with AI assistance, reviewed by me.)