OIDC provider: remember the sign-in across clients (SSO session) and support RP-initiated logout

Feature Ideas
1

Problem

We use Stalwart (v0.16.25, internal directory) as the OpenID provider for several apps (Immich, OpenCloud, Vikunja, Papra, Kutt, Bulwark). Each app sends the user to Stalwart’s login page, and every app asks for password and TOTP again, even right after signing in to another app in the same browser. Tested: the login (POST /api/auth) sets no cookie and nothing is stored in the browser, so there is no provider session to reuse. The provider settings (OidcProvider) only have token lifetimes.

There is also no logout endpoint: the discovery documents have no end_session_endpoint, so apps cannot sign the user out at the provider.

Proposal

  1. Provider session (SSO): after a successful login at /login, set a secure, HttpOnly session cookie for the web host. If it is valid, /login for another registered client completes the authorization without asking again (unless prompt=login or max_age require it). Configurable lifetime (e.g. sessionExpiry), ideally with a “remember me” option.
  2. RP-initiated logout: an end_session_endpoint in both discovery documents (OpenID Connect RP-Initiated Logout 1.0) that ends this session and redirects to a registered post_logout_redirect_uri.
  3. Optional: back-channel logout notifications to clients that registered a backchannel_logout_uri.

Why

Without this, families and small teams have to type password plus TOTP once per app and per device. Today we would have to put a second identity broker (Keycloak) in front of Stalwart just for this, although Stalwart already is a complete OIDC provider.

Setup

Stalwart v0.16.25 (Docker), RocksDB, internal directory, requireClientRegistration=true, ID tokens ES256.