fix: add redirect_after_logout_uri for ODIC that do not have an end_session_endpoint

[luoluoyuyu]

Description

Fixes #6791

Problem Analysis

When the openid service does not support end_session_endpoint, the ODIC logout fails to redirect to post_logout_redirect_uri. this issue is caused by the OpenID standard. end_session_endpoint does not necessarily need to be implemented.

Solution

Use the redirect_after_logout_uri defined in lua-resty-openidc for redirection when the OpenID service does not support end_session_endpoint.

Checklist

• I have explained the need for this PR and the problem it solves
• I have explained the changes or the new features added to this PR
• I have added tests corresponding to this change
• I have updated the documentation to reflect this change
• I have verified that this change is backward compatible (If not, please discuss on the APISIX mailing list first)

[Sn0rt]

1. new test for cover
2. user doc

[luoluoyuyu]

user doc

It's not necessary to add documentation, this PR is just to support services like Google that don't provide the end_session_endpoint configuration, and OIDC can also correctly using the post_logout_redirect_uri configuration.

[luoluoyuyu]

new test for cover

Auth0 now supports end_session_endpoint, now only found google openid service does not support end_session_endpoint, if you want to add test cases for google need to google account password, I think add test cases is not appropriate.
Here is the OpenID service that supports end_session_endpoint that I have organized:
Okta: https://developer.okta.com/docs/reference/api/oidc/#response-properties-10
Azure: https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols-oidc#single-sign-out
Auth0: https://auth0.com/docs/authenticate/login/logout/log-users-out-of-auth0#endpoint-discovery
Curity: https://curity.io/resources/learn/openid-connect-logout/#rp-initiated-logout
Connect2id: https://connect2id.com/products/nimbus-oauth-openid-connect-sdk#specs
Gluu: https://gluu.org/docs/gluu-server/4.3/api-guide/openid-connect-api/#openid-connect-end-session-api
IdentityServer: https://docs.duendesoftware.com/identityserver/v6/ui/logout/session_cleanup/#prompting-the-user-to-logout

[moonming]

can not merge without test cases

[moonming]

auth0

[shreemaan-abhishek]

great job

[kayx23]

@luoluoyuyu a question for the below:

What if someone configures both post_logout_redirect_uri and redirect_after_logout_uri?

https://github.com/zmartzone/lua-resty-openidc/blob/master/tests/spec/logout_spec.lua#L264-L299

[luoluoyuyu]

@luoluoyuyu a question for the below:

What if someone configures both post_logout_redirect_uri and redirect_after_logout_uri?

https://github.com/zmartzone/lua-resty-openidc/blob/master/tests/spec/logout_spec.lua#L264-L299

Hi @kayx23 'redirect_after_logout_uri' is not defined in the schema. If 'redirect_after_logout_uri' is configured, an error will occur. apisix/apisix/plugins/openid-connect.lua at master · apache/apisix (github.com)

[kayx23]

If 'redirect_after_logout_uri' is configured, an error will occur.

Not really true as previously shown.

However I will remove redirect_after_logout_uri from the new doc given this change.