Repository navigation
Document OpenID Connect sessions and SSO-only flows - #905
Merged
Merged
Conversation
KrzysztofPajak
commented
Oct 12, 2026
KrzysztofPajak
left a comment
KrzysztofPajak
left a comment
Member
Author
There was a problem hiding this comment.
Code review note: I reviewed the documentation-only changes for consistency with the stacked OIDC session, back-channel logout, SsoOnly, token age, and provider setup behavior. I found no high-confidence issues.\n\nI did not run docs tooling or test suites.
KrzysztofPajak
force-pushed
the
feature/oidc-sessions-guide-e2e
branch
from
October 13, 2026 18:30
7737688 to
b581ae6
Compare
KrzysztofPajak
force-pushed
the
feature/oidc-staff-sso-only
branch
from
October 13, 2026 18:30
86966bf to
9639992
Compare
Base automatically changed from
feature/oidc-staff-sso-only
to
feature/oidc-sessions-api
October 13, 2026 19:12
KrzysztofPajak
force-pushed
the
feature/oidc-sessions-guide-e2e
branch
from
October 13, 2026 19:13
b581ae6 to
22e7829
Compare
KrzysztofPajak
force-pushed
the
feature/oidc-sessions-api
branch
from
October 13, 2026 19:13
49c87d1 to
5306b24
Compare
…el instead of reinstalling, first session after registration or connection
…k-office sessions
…t, SsoOnly, offline_access by default
…ly for a full lock-out, browser-session cookies, revalidation load
… sessions, no token revocation without a provider refusal, earlier recovery links
KrzysztofPajak
force-pushed
the
feature/oidc-sessions-guide-e2e
branch
from
October 13, 2026 19:28
22e7829 to
67f0563
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves no public issue
Type: feature
Issue
The OpenID Connect guide needs to describe the new server-side session behavior, back-channel logout setup, SSO-only policy, stored token lifecycle, browser-session cookie behavior, and end-to-end provider configuration details for Keycloak and Zitadel.
Solution
Expand docs/oidc-resource-server.md with session and back-channel logout guidance, token and sign-out wording, SSO-only behavior, browser-session cookie notes, revalidation load expectations, Zitadel Refresh Token grant setup, and guidance for adding missing resources through the admin panel.
Breaking changes
None. Documentation only.
Testing
Not run during PR creation.