From 648326518c847a6f7db96937de2c1de941303574 Mon Sep 17 00:00:00 2001
From: Raphael Lullis <raphael@mushroomlabs.com>
Date: Tue, 29 Apr 2025 04:09:59 +0200
Subject: [PATCH 1/2] Backchannel Logout

 - Add migration to add backchannel logout support
 - Add parameters related to backchannel logout on OIDC Discovery View
 - Change application creation and update form
 - Change template that renders information about the application
---
 AUTHORS                                       |  1 +
 CHANGELOG.md                                  |  2 +-
 docs/oidc.rst                                 | 23 +++++
 docs/settings.rst                             | 16 ++++
 oauth2_provider/apps.py                       |  2 +-
 oauth2_provider/checks.py                     | 13 +++
 oauth2_provider/exceptions.py                 |  4 +
 oauth2_provider/handlers.py                   | 84 +++++++++++++++++++
 ...0014_application_backchannel_logout_uri.py | 19 +++++
 oauth2_provider/models.py                     |  4 +
 oauth2_provider/settings.py                   |  4 +
 .../oauth2_provider/application_detail.html   |  5 ++
 oauth2_provider/views/application.py          | 70 +++++++---------
 oauth2_provider/views/oidc.py                 |  7 ++
 tests/presets.py                              |  6 ++
 tests/test_backchannel_logout.py              | 80 ++++++++++++++++++
 tests/test_django_checks.py                   | 22 +++++
 tests/test_oidc_views.py                      | 12 +++
 18 files changed, 330 insertions(+), 44 deletions(-)
 create mode 100644 oauth2_provider/handlers.py
 create mode 100644 oauth2_provider/migrations/0014_application_backchannel_logout_uri.py
 create mode 100644 tests/test_backchannel_logout.py

diff --git a/AUTHORS b/AUTHORS
index 4ebe787cd..cd249c8b0 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -103,6 +103,7 @@ Peter McDonald
 Petr Dlouhý
 pySilver
 @realsuayip
+Raphael Lullis
 Rodney Richardson
 Rustem Saiargaliev
 Rustem Saiargaliev
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a29772c13..bff9310a5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,7 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 * Support for Django 5.2
 * Support for Python 3.14 (Django >= 5.2.8)
 * #1539 Add device authorization grant support
-
+* #1545 Support for OIDC Back-Channel Logout
 
 <!--
 ### Changed
diff --git a/docs/oidc.rst b/docs/oidc.rst
index 1669a00d4..f4a5f6c7c 100644
--- a/docs/oidc.rst
+++ b/docs/oidc.rst
@@ -169,6 +169,29 @@ This feature has to be enabled separately as it is an extension to the core stan
    }
 
 
+Backchannel Logout Support
+~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+`Backchannel Logout`_ is an extension to the core standard which
+allows the OP to send direct requests to terminate sessions at the RP.
+
+.. code-block:: python
+
+   OAUTH2_PROVIDER = {
+       # OIDC has to be enabled to use Backchannel logout
+       "OIDC_ENABLED": True,
+       "OIDC_ISS_ENDPOINT": "https://idp.example.com", # Required for issuing logout tokens
+       # Enable and configure Backchannel Logout Support
+       "OIDC_BACKCHANNEL_LOGOUT_ENABLED": True,
+       # ... any other settings you want
+   }
+
+.. _Backchannel Logout: https://openid.net/specs/openid-connect-backchannel-1_0.html
+
+To make use of this, the application being created needs to provide a
+valid `backchannel_logout_endpoint`.
+
+
 Setting up OIDC enabled clients
 ===============================
 
diff --git a/docs/settings.rst b/docs/settings.rst
index 9c71bb2a8..3076686b7 100644
--- a/docs/settings.rst
+++ b/docs/settings.rst
@@ -361,6 +361,7 @@ When is set to ``False`` (default) the `OpenID Connect RP-Initiated Logout <http
 endpoint is not enabled. OpenID Connect RP-Initiated Logout enables an :term:`Client` (Relying Party)
 to request that a :term:`Resource Owner` (End User) is logged out at the :term:`Authorization Server` (OpenID Provider).
 
+
 OIDC_RP_INITIATED_LOGOUT_ALWAYS_PROMPT
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 Default: ``True``
@@ -400,6 +401,21 @@ discovery metadata from ``OIDC_ISS_ENDPOINT`` +
 If unset, the default location is used, eg if ``django-oauth-toolkit`` is
 mounted at ``/o``, it will be ``<server-address>/o``.
 
+OIDC_BACKCHANNEL_LOGOUT_ENABLED
+~~~~~~~~~~~~~~~~~~~~~~~~
+Default: ``False``
+
+When is set to ``False`` (default) the `OpenID Connect Backchannel Logout <https://openid.net/specs/openid-connect-backchannel-1_0.html>`_
+extension is not enabled. OpenID Connect Backchannel Logout enables the :term:`Authorization Server` (OpenID Provider) to submit a JWT token to an endpoint controlled by the :term:`Client` (Relying Party)
+indicating that a session from the :term:`Resource Owner` (End User) has ended.
+
+OIDC_BACKCHANNEL_LOGOUT_HANDLER
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Default: ``oauth2_provider.handlers.send_backchannel_logout_request``
+
+Upon logout, the :term:`Authorization Server` (OpenID Provider)  will look for all ID Tokens associated with the user on applications that support Backchannel Logout. For every id token that is found, the function defined here will be called. The default function can be used as-is, but if you need to override or customize it somehow (e.g, if you do not want to execute these requests on the same HTTP request-response from the user logout view), you can change this setting to any function that takes an IDToken as the first parameter.
+
+
 OIDC_RESPONSE_TYPES_SUPPORTED
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 Default::
diff --git a/oauth2_provider/apps.py b/oauth2_provider/apps.py
index 3ad08b715..1a9b15993 100644
--- a/oauth2_provider/apps.py
+++ b/oauth2_provider/apps.py
@@ -7,4 +7,4 @@ class DOTConfig(AppConfig):
 
     def ready(self):
         # Import checks to ensure they run.
-        from . import checks  # noqa: F401
+        from . import checks, handlers  # noqa: F401
diff --git a/oauth2_provider/checks.py b/oauth2_provider/checks.py
index 848ba1af7..375049e20 100644
--- a/oauth2_provider/checks.py
+++ b/oauth2_provider/checks.py
@@ -26,3 +26,16 @@ def validate_token_configuration(app_configs, **kwargs):
         return [checks.Error("The token models are expected to be stored in the same database.")]
 
     return []
+
+
+@checks.register()
+def validate_backchannel_logout(app_configs, **kwargs):
+    errors = []
+
+    if oauth2_settings.OIDC_BACKCHANNEL_LOGOUT_ENABLED:
+        if not callable(oauth2_settings.OIDC_BACKCHANNEL_LOGOUT_HANDLER):
+            errors.append(checks.Error("OIDC_BACKCHANNEL_LOGOUT_HANDLER must be a callable."))
+        if not oauth2_settings.OIDC_ISS_ENDPOINT:
+            errors.append(checks.Error("OIDC_ISS_ENDPOINT must be set to enable OIDC backchannel logout."))
+
+    return errors
diff --git a/oauth2_provider/exceptions.py b/oauth2_provider/exceptions.py
index f68a651b6..e45de91b5 100644
--- a/oauth2_provider/exceptions.py
+++ b/oauth2_provider/exceptions.py
@@ -35,6 +35,10 @@ def __init__(self, description=None):
         super().__init__(message)
 
 
+class BackchannelLogoutRequestError(OIDCError):
+    error = "backchannel_logout_request_failed"
+
+
 class InvalidRequestFatalError(OIDCError):
     """
     For fatal errors. These are requests with invalid parameter values, missing parameters or otherwise
diff --git a/oauth2_provider/handlers.py b/oauth2_provider/handlers.py
new file mode 100644
index 000000000..0eca7300b
--- /dev/null
+++ b/oauth2_provider/handlers.py
@@ -0,0 +1,84 @@
+import json
+import logging
+from datetime import timedelta
+
+import requests
+from django.contrib.auth.signals import user_logged_out
+from django.dispatch import receiver
+from django.utils import timezone
+from jwcrypto import jwt
+
+from .exceptions import BackchannelLogoutRequestError
+from .models import AbstractApplication, get_id_token_model
+from .settings import oauth2_settings
+
+
+IDToken = get_id_token_model()
+
+logger = logging.getLogger(__name__)
+
+
+def send_backchannel_logout_request(id_token, *args, **kwargs):
+    """
+    Send a logout token to the applications backchannel logout uri
+    """
+
+    ttl = kwargs.get("ttl") or timedelta(minutes=10)
+
+    try:
+        assert oauth2_settings.OIDC_BACKCHANNEL_LOGOUT_ENABLED, "Backchannel logout not enabled"
+        assert id_token.application.algorithm != AbstractApplication.NO_ALGORITHM, (
+            "Application must provide signing algorithm"
+        )
+        assert id_token.application.backchannel_logout_uri is not None, (
+            "URL for backchannel logout not provided by client"
+        )
+
+        issued_at = timezone.now()
+        expiration_date = issued_at + ttl
+
+        claims = {
+            "iss": oauth2_settings.OIDC_ISS_ENDPOINT,
+            "sub": str(id_token.user.id),
+            "aud": str(id_token.application.client_id),
+            "iat": int(issued_at.timestamp()),
+            "exp": int(expiration_date.timestamp()),
+            "jti": id_token.jti,
+            "events": {"http://schemas.openid.net/event/backchannel-logout": {}},
+        }
+
+        # Standard JWT header
+        header = {"typ": "logout+jwt", "alg": id_token.application.algorithm}
+
+        # RS256 consumers expect a kid in the header for verifying the token
+        if id_token.application.algorithm == AbstractApplication.RS256_ALGORITHM:
+            header["kid"] = id_token.application.jwk_key.thumbprint()
+
+        token = jwt.JWT(
+            header=json.dumps(header, default=str),
+            claims=json.dumps(claims, default=str),
+        )
+
+        token.make_signed_token(id_token.application.jwk_key)
+
+        headers = {"Content-Type": "application/x-www-form-urlencoded"}
+        data = {"logout_token": token.serialize()}
+        response = requests.post(id_token.application.backchannel_logout_uri, headers=headers, data=data)
+        response.raise_for_status()
+    except (AssertionError, requests.RequestException) as exc:
+        raise BackchannelLogoutRequestError(str(exc))
+
+
+@receiver(user_logged_out)
+def on_user_logged_out_maybe_send_backchannel_logout(sender, **kwargs):
+    handler = oauth2_settings.OIDC_BACKCHANNEL_LOGOUT_HANDLER
+    if not oauth2_settings.OIDC_BACKCHANNEL_LOGOUT_ENABLED or not callable(handler):
+        return
+
+    user = kwargs["user"]
+    id_tokens = IDToken.objects.filter(application__backchannel_logout_uri__isnull=False, user=user)
+    for id_token in id_tokens:
+        try:
+            handler(id_token=id_token)
+        except BackchannelLogoutRequestError as exc:
+            logger.warn(str(exc))
diff --git a/oauth2_provider/migrations/0014_application_backchannel_logout_uri.py b/oauth2_provider/migrations/0014_application_backchannel_logout_uri.py
new file mode 100644
index 000000000..fae988330
--- /dev/null
+++ b/oauth2_provider/migrations/0014_application_backchannel_logout_uri.py
@@ -0,0 +1,19 @@
+# Generated by Django 5.2 on 2025-06-06 12:42
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("oauth2_provider", "0013_alter_application_authorization_grant_type_device"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="application",
+            name="backchannel_logout_uri",
+            field=models.URLField(
+                blank=True, help_text="Backchannel Logout URI where logout tokens will be sent", null=True
+            ),
+        ),
+    ]
diff --git a/oauth2_provider/models.py b/oauth2_provider/models.py
index 523ade289..054d944d8 100644
--- a/oauth2_provider/models.py
+++ b/oauth2_provider/models.py
@@ -79,6 +79,7 @@ class AbstractApplication(models.Model):
     * :attr:`client_secret` Confidential secret issued to the client during
                             the registration process as described in :rfc:`2.2`
     * :attr:`name` Friendly name for the Application
+    * :attr:`backchannel_logout_uri` Backchannel Logout URI (OIDC-only)
     """
 
     CLIENT_CONFIDENTIAL = "confidential"
@@ -152,6 +153,9 @@ class AbstractApplication(models.Model):
         help_text=_("Allowed origins list to enable CORS, space separated"),
         default="",
     )
+    backchannel_logout_uri = models.URLField(
+        blank=True, null=True, help_text="Backchannel Logout URI where logout tokens will be sent"
+    )
 
     class Meta:
         abstract = True
diff --git a/oauth2_provider/settings.py b/oauth2_provider/settings.py
index 216f36ba8..5d61064f3 100644
--- a/oauth2_provider/settings.py
+++ b/oauth2_provider/settings.py
@@ -101,6 +101,8 @@
         "client_secret_post",
         "client_secret_basic",
     ],
+    "OIDC_BACKCHANNEL_LOGOUT_ENABLED": False,
+    "OIDC_BACKCHANNEL_LOGOUT_HANDLER": "oauth2_provider.handlers.send_backchannel_logout_request",
     "OIDC_RP_INITIATED_LOGOUT_ENABLED": False,
     "OIDC_RP_INITIATED_LOGOUT_ALWAYS_PROMPT": True,
     "OIDC_RP_INITIATED_LOGOUT_STRICT_REDIRECT_URIS": False,
@@ -153,7 +155,9 @@
     "ACCESS_TOKEN_ADMIN_CLASS",
     "GRANT_ADMIN_CLASS",
     "ID_TOKEN_ADMIN_CLASS",
+    "LOGOUT_TOKEN_ADMIN_CLASS",
     "REFRESH_TOKEN_ADMIN_CLASS",
+    "OIDC_BACKCHANNEL_LOGOUT_HANDLER",
 )
 
 
diff --git a/oauth2_provider/templates/oauth2_provider/application_detail.html b/oauth2_provider/templates/oauth2_provider/application_detail.html
index 74b71ee74..0ba57cdfa 100644
--- a/oauth2_provider/templates/oauth2_provider/application_detail.html
+++ b/oauth2_provider/templates/oauth2_provider/application_detail.html
@@ -45,6 +45,11 @@ <h3 class="block-center-heading">{{ application.name }}</h3>
                 <p><b>{% trans "Allowed Origins" %}</b></p>
                 <textarea class="input-block-level" readonly>{{ application.allowed_origins }}</textarea>
             </li>
+
+            <li>
+              <p><b>{% trans "Backchannel Logout URI" %}</b></p>
+              <input class="input-block-level" type="text" value="{{ application.backchannel_logout_uri }}" readonly>
+            </li>
         </ul>
 
         <div class="btn-toolbar">
diff --git a/oauth2_provider/views/application.py b/oauth2_provider/views/application.py
index b896c45e3..6bea678ce 100644
--- a/oauth2_provider/views/application.py
+++ b/oauth2_provider/views/application.py
@@ -3,6 +3,8 @@
 from django.urls import reverse_lazy
 from django.views.generic import CreateView, DeleteView, DetailView, ListView, UpdateView
 
+from oauth2_provider.settings import oauth2_settings
+
 from ..models import get_application_model
 
 
@@ -17,33 +19,37 @@ def get_queryset(self):
         return get_application_model().objects.filter(user=self.request.user)
 
 
-class ApplicationRegistration(LoginRequiredMixin, CreateView):
+class ApplicationEditorMixin(LoginRequiredMixin):
+    def get_form_class(self):
+        """
+        Returns the form class for the application model
+        """
+        base_fields = [
+            "name",
+            "client_id",
+            "client_secret",
+            "hash_client_secret",
+            "client_type",
+            "authorization_grant_type",
+            "redirect_uris",
+            "post_logout_redirect_uris",
+            "allowed_origins",
+            "algorithm",
+        ]
+
+        if oauth2_settings.OIDC_BACKCHANNEL_LOGOUT_ENABLED:
+            base_fields.append("backchannel_logout_uri")
+
+        return modelform_factory(get_application_model(), fields=base_fields)
+
+
+class ApplicationRegistration(ApplicationEditorMixin, CreateView):
     """
     View used to register a new Application for the request.user
     """
 
     template_name = "oauth2_provider/application_registration_form.html"
 
-    def get_form_class(self):
-        """
-        Returns the form class for the application model
-        """
-        return modelform_factory(
-            get_application_model(),
-            fields=(
-                "name",
-                "client_id",
-                "client_secret",
-                "hash_client_secret",
-                "client_type",
-                "authorization_grant_type",
-                "redirect_uris",
-                "post_logout_redirect_uris",
-                "allowed_origins",
-                "algorithm",
-            ),
-        )
-
     def form_valid(self, form):
         form.instance.user = self.request.user
         return super().form_valid(form)
@@ -77,30 +83,10 @@ class ApplicationDelete(ApplicationOwnerIsUserMixin, DeleteView):
     template_name = "oauth2_provider/application_confirm_delete.html"
 
 
-class ApplicationUpdate(ApplicationOwnerIsUserMixin, UpdateView):
+class ApplicationUpdate(ApplicationOwnerIsUserMixin, ApplicationEditorMixin, UpdateView):
     """
     View used to update an application owned by the request.user
     """
 
     context_object_name = "application"
     template_name = "oauth2_provider/application_form.html"
-
-    def get_form_class(self):
-        """
-        Returns the form class for the application model
-        """
-        return modelform_factory(
-            get_application_model(),
-            fields=(
-                "name",
-                "client_id",
-                "client_secret",
-                "hash_client_secret",
-                "client_type",
-                "authorization_grant_type",
-                "redirect_uris",
-                "post_logout_redirect_uris",
-                "allowed_origins",
-                "algorithm",
-            ),
-        )
diff --git a/oauth2_provider/views/oidc.py b/oauth2_provider/views/oidc.py
index a252f1be4..120e1ba4b 100644
--- a/oauth2_provider/views/oidc.py
+++ b/oauth2_provider/views/oidc.py
@@ -101,8 +101,15 @@ def get(self, request, *args, **kwargs):
             "code_challenge_methods_supported": [key for key, _ in AbstractGrant.CODE_CHALLENGE_METHODS],
             "claims_supported": oidc_claims,
         }
+
+        if oauth2_settings.OIDC_BACKCHANNEL_LOGOUT_ENABLED:
+            data["backchannel_logout_supported"] = True
+            # We need to issue SID claims on tokens to support this.
+            data["backchannel_logout_session_supported"] = False
+
         if oauth2_settings.OIDC_RP_INITIATED_LOGOUT_ENABLED:
             data["end_session_endpoint"] = end_session_endpoint
+
         response = JsonResponse(data)
         response["Access-Control-Allow-Origin"] = "*"
         return response
diff --git a/tests/presets.py b/tests/presets.py
index 4538c64eb..13b9fac66 100644
--- a/tests/presets.py
+++ b/tests/presets.py
@@ -37,6 +37,12 @@
 OIDC_SETTINGS_RP_LOGOUT_DENY_EXPIRED["OIDC_RP_INITIATED_LOGOUT_ACCEPT_EXPIRED_TOKENS"] = False
 OIDC_SETTINGS_RP_LOGOUT_KEEP_TOKENS = deepcopy(OIDC_SETTINGS_RP_LOGOUT)
 OIDC_SETTINGS_RP_LOGOUT_KEEP_TOKENS["OIDC_RP_INITIATED_LOGOUT_DELETE_TOKENS"] = False
+OIDC_SETTINGS_BACKCHANNEL_LOGOUT = deepcopy(OIDC_SETTINGS_RW)
+OIDC_SETTINGS_BACKCHANNEL_LOGOUT["OIDC_BACKCHANNEL_LOGOUT_ENABLED"] = True
+
+OIDC_SETTINGS_BACKCHANNEL_LOGOUT_BAD_HANDLER = deepcopy(OIDC_SETTINGS_BACKCHANNEL_LOGOUT)
+OIDC_SETTINGS_BACKCHANNEL_LOGOUT_BAD_HANDLER["OIDC_BACKCHANNEL_LOGOUT_HANDLER"] = "not.a.real.function"
+
 REST_FRAMEWORK_SCOPES = {
     "SCOPES": {
         "read": "Read scope",
diff --git a/tests/test_backchannel_logout.py b/tests/test_backchannel_logout.py
new file mode 100644
index 000000000..57bf3dad6
--- /dev/null
+++ b/tests/test_backchannel_logout.py
@@ -0,0 +1,80 @@
+import datetime
+from unittest.mock import patch
+
+import pytest
+from django.utils import timezone
+from django.contrib.auth import get_user_model
+from django.test import RequestFactory
+from django.urls import reverse
+
+from oauth2_provider.exceptions import BackchannelLogoutRequestError
+from oauth2_provider.models import get_application_model, get_id_token_model
+from oauth2_provider.handlers import (
+    on_user_logged_out_maybe_send_backchannel_logout,
+    send_backchannel_logout_request,
+)
+from oauth2_provider.views import ApplicationRegistration
+
+from . import presets
+from .common_testing import OAuth2ProviderTestCase as TestCase
+
+
+Application = get_application_model()
+IDToken = get_id_token_model()
+User = get_user_model()
+
+
+@pytest.mark.usefixtures("oauth2_settings")
+@pytest.mark.oauth2_settings(presets.OIDC_SETTINGS_BACKCHANNEL_LOGOUT)
+class TestBackchannelLogout(TestCase):
+    def setUp(self):
+        self.developer = User.objects.create_user(username="app_developer", password="123456")
+        self.user = User.objects.create_user(username="app_user", password="654321")
+        self.application = Application.objects.create(
+            name="test_client_credentials_app",
+            user=self.developer,
+            client_type=Application.CLIENT_PUBLIC,
+            authorization_grant_type=Application.GRANT_CLIENT_CREDENTIALS,
+            algorithm=Application.RS256_ALGORITHM,
+            client_secret="1234567890asdfghjkqwertyuiopzxcvbnm",
+            backchannel_logout_uri="http://rp.example.com/logout",
+        )
+        now = timezone.now()
+        expiration_date = now + datetime.timedelta(minutes=180)
+        self.id_token = IDToken.objects.create(
+            application=self.application, user=self.user, expires=expiration_date
+        )
+
+    def test_on_logout_handler_is_called_for_user(self):
+        with patch("oauth2_provider.handlers.send_backchannel_logout_request") as backchannel_handler:
+            self.client.login(username="app_user", password="654321")
+            self.client.logout()
+            backchannel_handler.assert_called_once()
+            _, kwargs = backchannel_handler.call_args
+            self.assertEqual(kwargs["id_token"], self.id_token)
+
+    def test_logout_token_is_signed_for_user(self):
+        with patch("requests.post") as mocked_post:
+            self.client.login(username="app_user", password="654321")
+            self.client.logout()
+            mocked_post.assert_called_once()
+
+    def test_raises_exception_on_bad_application(self):
+        self.application.algorithm = Application.NO_ALGORITHM
+        self.application.save()
+        with self.assertRaises(BackchannelLogoutRequestError):
+            send_backchannel_logout_request(self.id_token)
+
+    def test_new_application_form_has_backchannel_logout_field(self):
+        factory = RequestFactory()
+        url = reverse("oauth2_provider:register")
+        request = factory.get(url)
+        request.user = self.user
+        view = ApplicationRegistration(request=request)
+        form = view.get_form()
+        self.assertTrue("backchannel_logout_uri" in form.fields.keys())
+
+    def test_logout_sender_does_not_crash_on_backchannel_error(self):
+        with patch("oauth2_provider.handlers.send_backchannel_logout_request") as mock_func:
+            mock_func.side_effect = BackchannelLogoutRequestError("Bad Gateway")
+            on_user_logged_out_maybe_send_backchannel_logout(sender=User, user=self.user)
diff --git a/tests/test_django_checks.py b/tests/test_django_checks.py
index 77025b115..9c954089c 100644
--- a/tests/test_django_checks.py
+++ b/tests/test_django_checks.py
@@ -1,8 +1,18 @@
+from copy import deepcopy
+
 from django.core.management import call_command
 from django.core.management.base import SystemCheckError
 from django.test import override_settings
 
 from .common_testing import OAuth2ProviderTestCase as TestCase
+from .presets import OIDC_SETTINGS_BACKCHANNEL_LOGOUT
+
+
+BAD_HANDLER_SETTINGS = deepcopy(OIDC_SETTINGS_BACKCHANNEL_LOGOUT)
+BAD_HANDLER_SETTINGS["OIDC_BACKCHANNEL_LOGOUT_HANDLER"] = "sys.api_version"
+
+MISSING_ISS_OIDC_ENDPOINT = deepcopy(OIDC_SETTINGS_BACKCHANNEL_LOGOUT)
+MISSING_ISS_OIDC_ENDPOINT["OIDC_ISS_ENDPOINT"] = None
 
 
 class DjangoChecksTestCase(TestCase):
@@ -18,3 +28,15 @@ def test_checks_fail_when_router_crosses_databases(self):
         message = "The token models are expected to be stored in the same database."
         with self.assertRaisesMessage(SystemCheckError, message):
             call_command("check")
+
+    @override_settings(OAUTH2_PROVIDER=BAD_HANDLER_SETTINGS)
+    def test_checks_fail_when_backchannel_logout_handler_is_not_callable(self):
+        message = "OIDC_BACKCHANNEL_LOGOUT_HANDLER must be a callable."
+        with self.assertRaisesMessage(SystemCheckError, message):
+            call_command("check")
+
+    @override_settings(OAUTH2_PROVIDER=MISSING_ISS_OIDC_ENDPOINT)
+    def test_checks_fail_when_iss_oidc_endpoint_is_missing(self):
+        message = "OIDC_ISS_ENDPOINT must be set to enable OIDC backchannel logout."
+        with self.assertRaisesMessage(SystemCheckError, message):
+            call_command("check")
diff --git a/tests/test_oidc_views.py b/tests/test_oidc_views.py
index 65197cbd1..5996d5647 100644
--- a/tests/test_oidc_views.py
+++ b/tests/test_oidc_views.py
@@ -152,6 +152,18 @@ def test_get_connect_discovery_info_without_rsa_key(self):
         self.assertEqual(response.status_code, 200)
         assert response.json()["id_token_signing_alg_values_supported"] == ["HS256"]
 
+    def test_get_backchannel_logout_support_info_when_enabled(self):
+        self.oauth2_settings.OIDC_BACKCHANNEL_LOGOUT_ENABLED = True
+        response = self.client.get(reverse("oauth2_provider:oidc-connect-discovery-info"))
+        response_data = response.json()
+        self.assertTrue("backchannel_logout_supported" in response_data)
+
+    def test_no_backchannel_logout_support_when_disabled(self):
+        self.oauth2_settings.OIDC_BACKCHANNEL_LOGOUT_ENABLED = False
+        response = self.client.get(reverse("oauth2_provider:oidc-connect-discovery-info"))
+        response_data = response.json()
+        self.assertFalse("backchannel_logout_supported" in response_data)
+
 
 @pytest.mark.usefixtures("oauth2_settings")
 @pytest.mark.oauth2_settings(presets.OIDC_SETTINGS_RW)

From 812bec09e045072b109dfc460cfe94b077ae50a0 Mon Sep 17 00:00:00 2001
From: Raphael Lullis <raphael@mushroomlabs.com>
Date: Thu, 18 Dec 2025 12:32:33 +0100
Subject: [PATCH 2/2] Send only one logout request per application, per user

---
 oauth2_provider/handlers.py      |  28 ++++++---
 tests/test_backchannel_logout.py | 104 ++++++++++++++++++++++++++++++-
 2 files changed, 124 insertions(+), 8 deletions(-)

diff --git a/oauth2_provider/handlers.py b/oauth2_provider/handlers.py
index 0eca7300b..f1ae6a73e 100644
--- a/oauth2_provider/handlers.py
+++ b/oauth2_provider/handlers.py
@@ -9,11 +9,12 @@
 from jwcrypto import jwt
 
 from .exceptions import BackchannelLogoutRequestError
-from .models import AbstractApplication, get_id_token_model
+from .models import AbstractApplication, get_id_token_model, get_refresh_token_model
 from .settings import oauth2_settings
 
 
 IDToken = get_id_token_model()
+RefreshToken = get_refresh_token_model()
 
 logger = logging.getLogger(__name__)
 
@@ -76,9 +77,22 @@ def on_user_logged_out_maybe_send_backchannel_logout(sender, **kwargs):
         return
 
     user = kwargs["user"]
-    id_tokens = IDToken.objects.filter(application__backchannel_logout_uri__isnull=False, user=user)
-    for id_token in id_tokens:
-        try:
-            handler(id_token=id_token)
-        except BackchannelLogoutRequestError as exc:
-            logger.warn(str(exc))
+    # Get refresh tokens for user where scope doesn't contain offline_access
+    refresh_tokens = (
+        RefreshToken.objects.filter(user=user, access_token__scope__isnull=False)
+        .exclude(access_token__scope__icontains="offline_access")
+        .select_related("application", "access_token")
+    )
+
+    # Group by application and send one request per application
+    applications_to_logout = set()
+    for rt in refresh_tokens:
+        if rt.application.backchannel_logout_uri and rt.application not in applications_to_logout:
+            applications_to_logout.add(rt.application)
+            # Find an ID token for this user/application to use for logout
+            id_token = IDToken.objects.filter(application=rt.application, user=user).first()
+            if id_token:
+                try:
+                    handler(id_token=id_token)
+                except BackchannelLogoutRequestError as exc:
+                    logger.warn(str(exc))
diff --git a/tests/test_backchannel_logout.py b/tests/test_backchannel_logout.py
index 57bf3dad6..e6df6db90 100644
--- a/tests/test_backchannel_logout.py
+++ b/tests/test_backchannel_logout.py
@@ -8,7 +8,12 @@
 from django.urls import reverse
 
 from oauth2_provider.exceptions import BackchannelLogoutRequestError
-from oauth2_provider.models import get_application_model, get_id_token_model
+from oauth2_provider.models import (
+    get_application_model,
+    get_id_token_model,
+    get_access_token_model,
+    get_refresh_token_model,
+)
 from oauth2_provider.handlers import (
     on_user_logged_out_maybe_send_backchannel_logout,
     send_backchannel_logout_request,
@@ -21,6 +26,8 @@
 
 Application = get_application_model()
 IDToken = get_id_token_model()
+AccessToken = get_access_token_model()
+RefreshToken = get_refresh_token_model()
 User = get_user_model()
 
 
@@ -45,6 +52,20 @@ def setUp(self):
             application=self.application, user=self.user, expires=expiration_date
         )
 
+        self.access_token = AccessToken.objects.create(
+            user=self.user,
+            application=self.application,
+            token="test_access_token",
+            expires=now + datetime.timedelta(hours=1),
+            scope="read write",  # No offline_access scope
+        )
+        self.refresh_token = RefreshToken.objects.create(
+            user=self.user,
+            application=self.application,
+            token="test_refresh_token",
+            access_token=self.access_token,
+        )
+
     def test_on_logout_handler_is_called_for_user(self):
         with patch("oauth2_provider.handlers.send_backchannel_logout_request") as backchannel_handler:
             self.client.login(username="app_user", password="654321")
@@ -78,3 +99,84 @@ def test_logout_sender_does_not_crash_on_backchannel_error(self):
         with patch("oauth2_provider.handlers.send_backchannel_logout_request") as mock_func:
             mock_func.side_effect = BackchannelLogoutRequestError("Bad Gateway")
             on_user_logged_out_maybe_send_backchannel_logout(sender=User, user=self.user)
+
+    def test_no_logout_sent_when_only_offline_access_refresh_tokens(self):
+        # Add offline_access scope
+        self.access_token.scope = "read write offline_access"
+        self.access_token.save()
+
+        with patch("oauth2_provider.handlers.send_backchannel_logout_request") as backchannel_handler:
+            on_user_logged_out_maybe_send_backchannel_logout(sender=User, user=self.user)
+            backchannel_handler.assert_not_called()
+
+    def test_logout_sent_when_refresh_token_without_offline_access(self):
+        with patch("oauth2_provider.handlers.send_backchannel_logout_request") as backchannel_handler:
+            on_user_logged_out_maybe_send_backchannel_logout(sender=User, user=self.user)
+            backchannel_handler.assert_called_once()
+            _, kwargs = backchannel_handler.call_args
+            self.assertEqual(kwargs["id_token"], self.id_token)
+
+    def test_only_one_logout_per_application_with_multiple_refresh_tokens(self):
+        # Create another refresh token for the same application
+        now = timezone.now()
+        another_access_token = AccessToken.objects.create(
+            user=self.user,
+            application=self.application,
+            token="test_access_token_2",
+            expires=now + datetime.timedelta(hours=1),
+            scope="read write",
+        )
+        RefreshToken.objects.create(
+            user=self.user,
+            application=self.application,
+            token="test_refresh_token_2",
+            access_token=another_access_token,
+        )
+
+        # Should still be called only once despite having 2 refresh tokens
+        with patch("oauth2_provider.handlers.send_backchannel_logout_request") as backchannel_handler:
+            on_user_logged_out_maybe_send_backchannel_logout(sender=User, user=self.user)
+            backchannel_handler.assert_called_once()
+
+    def test_logout_sent_for_multiple_applications(self):
+        # Create another application with backchannel logout URI
+        another_app = Application.objects.create(
+            name="test_app_2",
+            user=self.developer,
+            client_type=Application.CLIENT_PUBLIC,
+            authorization_grant_type=Application.GRANT_CLIENT_CREDENTIALS,
+            algorithm=Application.RS256_ALGORITHM,
+            client_secret="another_secret",
+            backchannel_logout_uri="http://rp2.example.com/logout",
+        )
+
+        # Create ID token for the second application
+        another_id_token = IDToken.objects.create(
+            application=another_app, user=self.user, expires=timezone.now() + datetime.timedelta(minutes=180)
+        )
+
+        # Create access token and refresh token for the second application
+        now = timezone.now()
+        another_access_token = AccessToken.objects.create(
+            user=self.user,
+            application=another_app,
+            token="test_access_token_app2",
+            expires=now + datetime.timedelta(hours=1),
+            scope="read write",
+        )
+        RefreshToken.objects.create(
+            user=self.user,
+            application=another_app,
+            token="test_refresh_token_app2",
+            access_token=another_access_token,
+        )
+
+        # Should be called twice - once for each application - and both ID tokens were used
+        with patch("oauth2_provider.handlers.send_backchannel_logout_request") as backchannel_handler:
+            on_user_logged_out_maybe_send_backchannel_logout(sender=User, user=self.user)
+            self.assertEqual(backchannel_handler.call_count, 2)
+
+            call_args_list = backchannel_handler.call_args_list
+            id_tokens_called = [call.kwargs["id_token"] for call in call_args_list]
+            self.assertIn(self.id_token, id_tokens_called)
+            self.assertIn(another_id_token, id_tokens_called)