Single sign out from multiple applications from Doorkeeper provider

Question

I'm using Doorkeeper for my Rails app, and I'm trying to make so that when a user signs out from the doorkeeper provider, the user will automatically signs out from all apps.

By default, when a user signs out from an app, he will still be signed in at the doorkeeper provider app.

This is my session controller from my Doorkeeper provider.

class SessionsController < ApplicationController
  def new
    redirect_to root_path if current_user
    session[:return_to] = params[:return_to] if params[:return_to]
  end

  def create
    user = User.find_by_email(params[:email])
    if user && user.authenticate(params[:password])
      session[:user_id] = user.id
      if session[:return_to]
        redirect_to session[:return_to]
        session[:return_to] = nil
      else
        redirect_to root_path

      end
    else
      flash.now.alert = "Email or password is invalid"
      render "new"
    end
  end

  def destroy
    session[:user_id] = nil
    flash[:alert] = "Sign Out successfully"
    redirect_to new_session_path
  end
end

This is my session controller from one of my app:

    class SessionsController < ApplicationController
  def create
    auth = request.env["omniauth.auth"]
    user = User.find_by_provider_and_uid(auth["provider"], auth["uid"]) || User.create_with_omniauth(auth)
    session[:user_id] = user.id
    session[:access_token] = auth["credentials"]["token"]
    redirect_to root_url
  end

  def destroy
    session[:user_id] = nil
    session[:access_token] = nil
    redirect_to root_url
  end
end

I wrote my own user authentication for the Doorkeeper provider app, but I used Devise for own of my app connected to my Doorkepeer provider app.

At the moment, when I sign out from my Doorkeeper app, I'm still signed in at my other app. So how do I make so that I sign out from Doorkeeper, and that will make me sign out from all apps as well?

Answer 1

you would have to either send an API call from the doorkeeper app to each client app telling them to remove sessions for specific user, or you would need to have your client app query the doorkeeper app regularly to ensure that the session or access token is still active. The latter is probably the better strategy, although it will end up making more API calls.

Answer 2

I think this article will be helpful:

A Sane Oauth Federation Strategy With Doorkeeper in Ruby