Sign out functionality

.github/workflows/E2E.yml

@@ -52,13 +52,37 @@ jobs:
 
     - uses: actions/checkout@v2
 
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v2
+
+    - name: Login to Docker Hub
+      uses: docker/login-action@v2
+      with:
+        username: ${{ secrets.IBERSANO_DOCKER_USERNAME }}
+        password: ${{ secrets.IBERSANO_DOCKER_TOKEN }}
+
+    - name: Extract metadata (tags, labels) for Docker
+      id: meta
+      uses: docker/metadata-action@v4
+      with:
+        images: |
+          ${{ vars.docker_repo }}/easy-auth-proxy
+
+    - name: Build and push Docker images
+      uses: docker/build-push-action@v3
+      with:
+        context: .
+        push: true
+        tags: ${{ steps.meta.outputs.tags }}
+        labels: ${{ steps.meta.outputs.labels }}
+
     - name: Call the script
       continue-on-error: true
       run: |
-        bash main.sh -a "${{ vars.e2ePrefix }}-${{ env.GITHUB_PR_NUMBER }}" -c "${{ vars.e2ePrefix }}-${{ env.GITHUB_PR_NUMBER }}" -r "${{ vars.e2ePrefix }}-${{ env.GITHUB_PR_NUMBER }}" -e ${{ vars.email }} -l ${{ vars.location }}
+        bash main.sh -i ${{ vars.imageName }} -a "${{ vars.e2ePrefix }}-${{ env.GITHUB_PR_NUMBER }}" -c "${{ vars.e2ePrefix }}-${{ env.GITHUB_PR_NUMBER }}" -r "${{ vars.e2ePrefix }}-${{ env.GITHUB_PR_NUMBER }}" -e ${{ vars.email }} -l ${{ vars.location }}
 
     - name: Delete e2e environment
-      if: ${{ vars.DeleteOnFailure == 'true' }} || success()
+      if: ${{ vars.DeleteOnFailure == 'true' }}
       run: |
           if [ $(az group exists --name ${{ vars.e2ePrefix }}-${{ env.GITHUB_PR_NUMBER }}) == "true" ]; then
               az group delete -n ${{ vars.e2ePrefix }}-${{ env.GITHUB_PR_NUMBER }} --yes

.github/workflows/ci.yml

@@ -62,28 +62,28 @@ jobs:
         uses: actions/checkout@v2
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9
+        uses: docker/login-action@v2
         with:
           username: ${{ secrets.DOCKER_USER_ID }}
           password: ${{ secrets.DOCKER_REGISTRY_PASS }}
 
       - name: Log in to the Container registry
-        uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9
+        uses: docker/login-action@v2
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
+        uses: docker/metadata-action@v4
         with:
           images: |
             ghcr.io/${{ github.repository }}/easy-auth-proxy
             easyauthfork8s/easy-auth-proxy
 
       - name: Build and push Docker images
-        uses: docker/build-push-action@ad44023a93711e3deb337508980b4b5e9bcdc5dc
+        uses: docker/build-push-action@v3
         with:
           context: .
           push: true

charts/easyauth-proxy/templates/statefulset.yaml

@@ -57,6 +57,8 @@ spec:
                 value: "{{ .Values.easyAuthForK8s.dataProtectionFileLocation }}"           
              -  name: EasyAuthForK8s__SigninPath
                 value: "{{ .Values.basePath }}{{ .Values.easyAuthForK8s.signinPath }}"
+             -  name: EasyAuthForK8s__SignoutPath
+                value: "{{ .Values.basePath }}{{ .Values.easyAuthForK8s.signoutPath }}"
              -  name: EasyAuthForK8s__AuthPath
                 value: "{{ .Values.basePath }}{{ .Values.easyAuthForK8s.authPath }}"
              -  name: EasyAuthForK8s__AllowBearerToken

charts/easyauth-proxy/values.yaml

@@ -114,6 +114,7 @@ easyAuthForK8s:
   # such as another easyauth proxy using the same host name
   signinPath: "/login"
   authPath: "/auth"
+  signoutPath: "/logout"
   # use bearer token as a fall back for cookies
   # normally for API web applications only
   allowBearerToken: "false"

sample/EasyAuthForK8s.Sample/Pages/Shared/_Layout.cshtml

@@ -32,7 +32,7 @@
                             <a class="nav-link" href="/Graph">Graph Query</a>
                         </li>
                         <li class="nav-item">
-                            <a class="nav-link" href="/Anonymous" onclick="alert('Please open a GitHub issue if you need a sign out example.')">Sign Out</a>
+                            <a class="nav-link" href="/easyauth/logout" >Sign Out</a>
                         </li>
                     </ul>
                 </div>

sample/templates/sample-ingress.yaml

@@ -25,7 +25,6 @@ spec:
             name: easyauth-sample-pod
             port:
               number: 80
-
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress

src/EasyAuthForK8s.Web/EasyAuthConfigurationOptions.cs

@@ -3,6 +3,7 @@ public class EasyAuthConfigurationOptions
 {
     public string DataProtectionFileLocation { get; set; } = "C:\\mnt\\dp";
     public string SigninPath { get; set; } = "/easyauth/login";
+    public string SignoutPath { get; set; } = "/easyauth/logout";
     public string AuthPath { get; set; } = "/easyauth/auth";
     public bool AllowBearerToken { get; set; } = false;
     /// <summary>

src/EasyAuthForK8s.Web/EasyAuthMiddleWare.cs

@@ -13,6 +13,7 @@
 using System;
 using System.Collections.Generic;
 using System.Linq;
+using System.Net.Http;
 using System.Security.Claims;
 using System.Text;
 using System.Threading.Tasks;
@@ -58,6 +59,11 @@ public async Task InvokeAsync(HttpContext context)
             await HandleAuth(context);
             return;
         }
+        else if (_configureOptions.SignoutPath == context.Request.Path)
+        {
+            await HandleLogout(context);
+            return;
+        }
 
         // Call the next delegate/middleware in the pipeline
         await _next(context);
@@ -236,6 +242,19 @@ public async Task HandleAuth(HttpContext context)
 
     }
 
+    public async Task HandleLogout(HttpContext context)
+    {
+        EasyAuthState state = context.EasyAuthStateFromHttpContext();
+
+        LogRequestHeaders("HandleLogout", context.Request);
+
+        // Delete the cookie
+        context.Response.Cookies.Delete(Constants.CookieName);
+
+        // Re route the user to Azure AD to logout
+        await context.SignOutAsync(OpenIdConnectDefaults.AuthenticationScheme, new AuthenticationProperties { RedirectUri = _configureOptions.DefaultRedirectAfterSignin }) ;
+    }
+
     private void LogRequestHeaders(string prefix, HttpRequest request)
     {
         StringBuilder sb = new StringBuilder();

src/EasyAuthForK8s.Web/appsettings.json

@@ -18,6 +18,7 @@
   "EasyAuthForK8s": {
     "DataProtectionFileLocation": "/mnt/dp",
     "SigninPath": "/easyauth/login",
+    "SignoutPath": "/easyauth/logout",
     "AuthPath": "/easyauth/auth",
     "AllowBearerToken": false,
     "DefaultRedirectAfterSignin": "/",