feat(sso): RP-initiated logout + session/token revocation

Phase A2 of #8994.

OIDC RP-initiated logout (end_session_endpoint) and SAML SLO; revoke the local session/token on logout. Wire frontend logout to it.

AC:

Design: docs/superpowers/specs/2026-06-15-enterprise-sso-federation-design.md (branch issue-8994). Parent sub-umbrella #8994 (under umbrella #9930).

Scope decided (industry-standard, highest-security):

OIDC RP-initiated logout (end_session_endpoint) + SAML SLO + audit LOGOUT.
jti-denylist revocation for SLM-issued HS256 tokens — added in SLM services/auth.py (mint adds jti; decode_token/decode_token_async reject denylisted jti), Redis key TTL = token remaining lifetime. NOT in shared jwt_core (avoids forking epic(auth): unify AutoBot + SLM into ONE user store with role-based access (SLM = role-gated view, not a separate userbase) #10193).
Frontend logout calls backend before clearing storage.
Cross-service RS256 authority-token revocation is out of SLM's control → spun out as feat(auth): cross-service revocation of RS256 authority tokens (coordinate with #10193) #10278 (coordinate with epic(auth): unify AutoBot + SLM into ONE user store with role-based access (SLM = role-gated view, not a separate userbase) #10193).
Grounding: tokens are stateless HS256 JWTs, no prior logout endpoint/store; mint at services/auth.py:create_token_response, decode at decode_token/decode_token_async.

feat(sso): Phase A enterprise hardening — RP-logout+revocation, group…

PR #10426 (merged to Dev_new_gui) references this issue with a close keyword.

feat(sso): Phase A enterprise hardening — RP-logout+revocation, group→role, PKCE docs (#10151, #10152, #10155)

If this issue is fully resolved, close it manually. If work remains, no action is needed.

Delivered via PR #10426 (squash-merged to Dev_new_gui).

Navigation Menu