OpenID Connect: keep local accounts and logout usable when a default provider is set #620

Affected capability

User/Permission/Role

Feature description

pimcore_open_id_connect.default_provider makes Pimcore Studio's login page redirect straight to the identity provider. Two consequences make the setting hard to use in practice, independent of the bug reported in #619:

1. Local accounts cannot reach the credentials form. /pimcore-studio/login redirects as soon as it renders, so a Pimcore user without an account at the provider (emergency admin, service account, a consultant during an incident) has no page to sign in on. The documentation's only recovery is to remove the bundle or the setting. Going "Back" from the provider skips Studio, because the redirect was added to the history without a user gesture. Login links generated in user management for local users (/pimcore-studio/login?token=…) are overtaken by the same redirect. (The current workaround is to POST credentials to /pimcore-studio/api/login by hand.)

2. Logout signs the user straight back in. The Studio logout calls /pimcore-studio/api/logout and reloads the current URL; the guarded route renders the login in place, which redirects to the provider, and the provider's session signs the user in again. A user who wants to switch accounts or leave a shared machine cannot.

This was discussed in pimcore/openid-connect#7 ("Logout-Button for SSO-Users", open since 2022, label "PR Welcome"), where @fashxp preferred to "logout from Pimcore and redirect to login page to allow login with a local user". The Portal Engine already has this model for its always_redirect option: the redirect happens only from the firewall entry point, its /auth/login page never redirects by itself (local accounts can always sign in there), and logout lands on that page.

Proposal for Studio (2026.x):

• Keep the automatic redirect for the case it is meant for: an unauthenticated visit to a guarded Studio URL (the login rendered in place since studio-ui-bundle 2026.3). Do not redirect automatically on /pimcore-studio/login itself, which stays the page for local accounts and for retrying after a failed attempt; it keeps showing the provider buttons.
• After logout, land on /pimcore-studio/login and do not start the redirect for that visit (e.g. a short-lived cookie set by a LogoutEvent listener that makes OidcAppConfigProvider omit the default provider until the next sign-in, or a query flag on the login URL as the bug fix already uses for failed attempts).
• Optionally end the provider session too on logout (end_session_endpoint from the discovery document), as a separate option, since this is a behaviour change for users who expect single logout only when configured.

Happy to prepare a PR once the direction is agreed.