feat(auth): add id_token_hint to OIDC RP-Initiated Logout

[gomitrah]

The OIDC RP-Initiated Logout redirect built in buildOIDCEndSessionURL
only sent client_id and post_logout_redirect_uri to the provider's
end_session_endpoint. Some OIDC providers (e.g. Dex) require
id_token_hint to complete logout per the RP-Initiated Logout
spec,
so logout against those providers couldn't be completed correctly.

This stores the id_token returned by the provider at sign-in in the
session (session.KeyOIDCIDToken), and passes it back as
id_token_hint on logout when present. Sessions that predate this
change, or providers that don't return an id_token, keep the
previous behavior — the parameter is only added when a token is
actually available.

Testing

Unit tests covering: a real OAuth2 callback with an id_token
populates the session and the logout redirect includes
id_token_hint; a callback without an id_token omits the parameter
entirely; existing OIDC-logout and password-login-skips-OIDC
behavior is unchanged
Verified end-to-end against a live Keycloak instance: before this
change the logout redirect omitted id_token_hint, after, it's
present as a valid JWT matching the session
make lint-go, make fmt

Closes #38692.

[Copilot]

Pull request overview

This PR improves OIDC RP-Initiated Logout compatibility by persisting the OIDC id_token in the user session at sign-in time and reusing it as id_token_hint when building the provider end_session_endpoint redirect during logout.

Changes:

• Store goth.User.IDToken into the session (session.KeyOIDCIDToken) during OAuth2/OIDC sign-in (including 2FA and link-account 2FA flows) when present.
• Add id_token_hint to the OIDC end-session URL when the session contains a non-empty stored ID token.
• Add/extend unit tests to cover ID token persistence and inclusion/omission of id_token_hint.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
routers/web/auth/oauth.go	Stores id_token in session on OAuth2/OIDC sign-in and adds id_token_hint to the logout redirect when available.
routers/web/auth/linkaccount.go	Stores id_token in session during OAuth2 link-account 2FA session setup.
routers/web/auth/auth_test.go	Adds tests asserting session storage of id_token and presence/absence of id_token_hint on logout redirects.
modules/session/key.go	Introduces session.KeyOIDCIDToken session key constant and documentation.

Suppressed comments (1)

routers/web/auth/oauth.go:466

• Same session-regeneration issue as the non-2FA path: if this OAuth2/OIDC callback doesn’t yield an id_token, the previous session.KeyOIDCIDToken value can be carried into the regenerated 2FA session and later used as a stale id_token_hint. Clear the key before calling regenerateSession.

	sessionData := map[string]any{
		"twofaUid":              u.ID,
		"twofaRemember":         false,
		session.KeySignInMethod: session.SignInMethodOAuth2,
	}
	if gothUser.IDToken != "" {

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.