OIDC: after a successful single logout, land on the login page that redirects

[mastacontrola]

Reported from the lab, with single logout and forced redirect both on: signing
out left you on management/login.php — the break-glass page — instead of FOG's
ordinary login page.

Why #18 got this wrong

#18 pointed post_logout_redirect_uri at login.php to avoid a loop:
index.php on a forced-redirect install sends the browser back to the provider,
and if the provider session were still alive that is a silent re-login.

But single logout is exactly the case where the provider session is not still
alive. It was just ended, by the request carrying this parameter. So the
browser returns to index.php, index.php sends it to the provider, the
provider has no session, and it asks who you are — signing out and signing in as
somebody else in one continuous journey, which is the thing single logout exists
to make possible. It was being cut short one page early.

The two landings are now separate

They answer different questions, so collapsing them re-creates whichever bug the
other was avoiding:

Method	Lands on	Because
OIDC::postLogoutUri()	management/index.php	The provider session has been ended, so bouncing back to it is correct
OIDC::localLoginUrl()	management/login.php	Bouncing back would loop or silently re-authenticate

localLoginUrl() is used in three places, all of them cases where the provider
must not be re-entered: OIDCFlow::_fail() (the provider just refused, so
returning to it is a loop); the USER_LOGGING_OUT fallback when single logout is
off and forced redirect is on (the SSO session is untouched); and the URL
printed beside the forced-redirect setting, which is the escape hatch and must
never be the redirecting page.

⚠️ Admins must re-register the post-logout redirect URI

It changes from …/management/login.php to …/management/index.php. Providers
that follow the spec refuse an unregistered one and show their own error page
instead of returning, so an install upgrading from v1.6.9 has to update it at the
provider. The management page prints the current value.

Verification

7/7 mutations caught. sh tests/run-all.sh → 6 passed, 0 failed.

Both gates updated. The single-logout gate now pins the two URLs separately,
pins that they differ, and pins post_logout_redirect_uri as a key/value
pair rather than merely mentioning the method — a mutation that rebound the value
to a different parameter name survived the first draft, which would have meant a
logout that worked and looked broken.

Live-confirmed by the reporter that redirect and logout otherwise work end to end
against Keycloak.

🤖 Generated with Claude Code

https://claude.ai/code/session_017aBSWrDArXHTpKWkkN27LR