How to check if user still logged in via azure sso (oAuth2), while using my own webapp?

问题

I'm developing an web application with Spring Boot using Azure AD and OAuth2.0 for authentication to secure up the backend.

If I log-out via for example the Outlook Web App, my web application should register this process and logout as well (at least if I reload or reopen the page). How do i implement that? Now the Web-Application seems as still logged in. Unfortunately I did not find an approach to implement this behavior consistently. Only if I use the self-implemented log-out button, it shows the desired effect and the HttpSession gets invalidated and cookies where deleted.

I have already implemented a login and logout via Azure AD in my web application (see code). As soon as I log-out via the button of my own application, I am automatically logged out of other Azure applications (e.g. Outlook Web App) that require Azure SSO.

I already tried the @PreAuthorize Annotation discribed here Spring MVC - Checking if User is already logged in via Spring Security? but this seems not to be the solution.

 protected void configure(HttpSecurity http) throws Exception {
        http
                .authorizeRequests()
                .anyRequest().authenticated()
                .and()
                .oauth2Login()
                .userInfoEndpoint()
                .oidcUserService(oidcUserService);

        http.logout()
                .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
                .invalidateHttpSession(true)
                .deleteCookies("JSESSIONID")
                .clearAuthentication(true)
                .logoutSuccessUrl("https://login.microsoftonline.com/common/oauth2/logout");
}

Redirect to main page:

    @GetMapping("login/oauth2/code/azure")
    public ModelAndView redirectToRoot(ModelMap modelMap) {
            return new ModelAndView("redirect:/", modelMap);
    }

回答1:

I have never implemented this myself, but if I remember right, all OAuth2 providers have some kind of a SingleSignOut endpoint, if you call this in your logout method, it will log the user out from every app that is connected to this provider. After refreshing the page of your webapp, the security should recognize that the user is then no longer logged in and redirect him to the login page. Hope I could help you a bit. :)

Edit: I found this after a quick search: https://github.com/juanzero000/spring-boot-oauth2-sso .

来源：https://stackoverflow.com/questions/56645587/how-to-check-if-user-still-logged-in-via-azure-sso-oauth2-while-using-my-own