Enable SSO and RP-initiated logout for the console application

[madurangasiriwardena]

Purpose

This PR enables SSO for the console login flow (reuse an existing session instead of forcing a fresh login) and adds OIDC RP-Initiated Logout for console sign-out.

Today the console login flow does not use SSO, so each sign-in is a fresh authentication and sign-out only clears the local session. Introducing SSO establishes a server-side session, which then has to be terminated on sign-out rather than left to expire. So this change pairs the SSO login flow with a console sign-out flow: signing out now confirms, terminates the SSO session server-side, and returns the user to the console.

Approach

• Bootstrap flows (01-default-resources.yaml):
  • Console login flow gains SSO reuse: a SSOCheckExecutor step (reuse the existing session when present) followed by a SessionExecutor step (establish/refresh it).
  • New Console App Sign Out Flow (flowType: SIGNOUT): a confirmation prompt, then session termination via SessionSignOutExecutor. Node layout mirrors the "Basic Sign Out Flow" template so the graph renders cleanly.
  • Console client links the sign-out flow (signOutFlowId + isSignOutFlowEnabled) and registers postLogoutRedirectUris.
• Frontend: no provider config is required. The console's existing signOut() performs RP-Initiated Logout via the SDK default (redirect to the end_session_endpoint, then back to the console). DashboardLayout gets an explanatory comment only; the generic-OIDC path is unchanged (it logs out at the external IdP directly and never calls the SDK signOut()).

Related Issues

• Session logout support #2036

Related PRs

• Add OIDC RP-Initiated Logout support to signOut() javascript-sdks#36

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified.
• Documentation provided. (Add links if there are any)
  • Ran Vale and fixed all errors and warnings
• Tests provided. (Add links if there are any)
  • Unit Tests
  • Integration Tests
• Breaking changes. (Fill if applicable)
  • Breaking changes section filled.
  • breaking change label added.

Security checks

• Followed secure coding standards in WSO2 Secure Coding Guidelines
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

Summary by CodeRabbit

• New Features

  • Added an SSO check before console credential sign-in.
  • Added a dedicated console sign-out flow with confirmation and session termination.
  • Enabled post-logout redirects for the console.

• Bug Fixes

  • Improved authentication flow handling when SSO checks succeed or fail.
  • Updated end-to-end login validation to support the new multi-step authentication process.

• Documentation

  • Documented native session sign-out behavior, including fallback handling when provider logout is unavailable.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Console authentication now performs an SSO check before credential prompting, while credentials continue through a session task. A confirmation-based sign-out flow is added, enabled for the Console application, and configured with OAuth post-logout redirects. E2E login execution now uses a challenge token.

Changes

Console authentication and sign-out

Layer / File(s)	Summary
SSO-first authentication and E2E login .github/workflows/pr-builder.yml, backend/cmd/server/bootstrap/01-default-resources.yaml	Console authentication routes through sso_check and session; the E2E workflow executes login in two steps using a challenge token.
Confirmation-based sign-out integration backend/cmd/server/bootstrap/01-default-resources.yaml, frontend/apps/console/src/layouts/DashboardLayout.tsx	A console-signout-flow confirms sign-out, executes SessionSignOutExecutor, enables the flow for Console, configures post-logout redirects, and documents native logout behavior.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Console
  participant SSOCheckExecutor
  participant SessionExecutor
  participant AuthorizationCheck
  Console->>SSOCheckExecutor: Check existing SSO session
  SSOCheckExecutor->>SessionExecutor: Route on success
  SessionExecutor->>AuthorizationCheck: Continue authentication
  SSOCheckExecutor->>Console: Route to credential prompt on failure

Loading

sequenceDiagram
  participant Console
  participant PromptConfirm
  participant SessionSignOutExecutor
  participant IdentityProvider
  Console->>PromptConfirm: Request sign-out confirmation
  PromptConfirm->>SessionSignOutExecutor: Submit confirmation
  SessionSignOutExecutor->>IdentityProvider: Perform session logout
  IdentityProvider-->>Console: Redirect to post-logout URI

Loading

Possibly related PRs

• thunder-id/thunderid#4189: Uses the same two-step flow execution and challenge-token pattern for admin login.
• thunder-id/thunderid#3969: Updates the same E2E admin login setup in the Playwright workflow.
• thunder-id/thunderid#4206: Updates the Console sign-out confirmation experience.

Suggested reviewers: donomalvindula, brionmario

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main change: enabling SSO and RP-initiated logout for the console.
Description check	✅ Passed	The description follows the template with Purpose, Approach, Related Issues, Related PRs, Checklist, and Security checks.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!