Okta integration, Logout fails to send client_id, results in error

Working on this

I still have an issue with those changes:

LogicException: The controller result claims to be providing relevant cache metadata, but leaked metadata was detected. Please ensure you are not rendering content too early. Returned object class: Drupal\Core\Routing\TrustedRedirectResponse. in Drupal\Core\EventSubscriber\EarlyRenderingControllerWrapperSubscriber->wrapControllerExecutionInRenderContext() (line 154 of /app/web/core/lib/Drupal/Core/EventSubscriber/EarlyRenderingControllerWrapperSubscriber.php)

because of the TrustedRedirectResponse for the end_session redirect. This does not happen, when the response is a simple RedirectResponse!

There is also an issue in line 311, without passing "TRUE", you can not call for getGeneratedUrl(), it is not necessary anyway.
May be there should be simply a simple target url redefinition instead of creating an entirely new redirect.

Still worked on this for a while now. I could only solve the early rendering issue by executing 'user_logout()' in its own render context.

Could not be applied to latest master, here an updated version.

A lot of the code being changed in #10 should not. If the user does not set a logout URL they should not be redirected to Drupal's frontpage. Does that leave them in the login/logout page for the IDP? Yeah. But that's what is expected when not setting the path. If the site builder wants to redirect to the frontpage, then they should configure that field as <front>.

Also, why are you setting all URLs to absolute? That I know of, only the post_logout_redirect_uri needs to be set to absolute. And a caching dependency on the logout URL and the entity? Why are these required?

I think the #10 patch would probably be a lot easier to understand if those changes were reverted.

Seems to me the only changes are:

+            $response->addCacheableDependency($end_session_endpoint);
             $response->addCacheableDependency($redirect);
+            $response->addCacheableDependency($entity);

and

-    user_logout();
+    $context = new RenderContext();
+    $this->renderer->executeInRenderContext($context, 'user_logout');

Other than all the renderer dependency injection and the executeInRenderContext() which seems to be a way to mask the problem.

A problem I've not been able to reproduce, BTW.

see https://www.drupal.org/project/openid_connect/issues/3216938#comment-141...

Regarding the front page redirect fallback, in case of Gluu Server I am using, see issue #3214681, the user ends up on an empty page after logout. The user is stuck there. When I leave the field empty I would have expected to end up on the default Drupal logout redirect page, as any other user, which is the front page.

The caching dependency on the entity is required because the generated redirect depends on the configuration of the provider. The caching dependency on the logout URL I added for the same reason. When I leave the configuration option empty I would use the default Drupal logout redirect page, which is not part of the entity settings.

In case of the provider does not support the end_session URL, you should not return a TrustedRedirectResponse, as the URL is always an internal URL. A reassignment of the target URL is enough.

I could not pin down the problem to a source either, only can tell it happens.

As the changes in #10 seem to be a lot of lines to hide the real problem, and the fact that #12 seems to fix the problem to some people and it is a lot simpler, I'm going to commit that one in hopes that the problem (that I never experienced) gets fixed.