Major Bugfix

docs/ACCESS-AUTH.md

@@ -59,16 +59,18 @@ The browser cookie contains only a cryptographically-random opaque token. Sessio
 Configure the PocketID client with:
 
 ```text
+Public client: OFF
+PKCE: ON
 Callback URL:
 https://guacamole.example.org/_sessionguard/auth/oidc/callback
 
-Logout Callback / Back-channel Logout URL:
-https://guacamole.example.org/_sessionguard/auth/backchannel-logout
+Logout Callback URL (post_logout_redirect_uri):
+https://guacamole.example.org/
 ```
 
-PocketID can send OIDC back-channel logout tokens to the latter URL. SessionGuard verifies signature, issuer, audience, event claim, `iat`, `jti`, and `sid`/`sub`, rejects replayed logout tokens, and revokes matching local access sessions.
+The Pocket ID field **Logout Callback URLs** is the allow-list for `post_logout_redirect_uri`; do not put the SessionGuard back-channel endpoint into that field. If the provider exposes a dedicated Back-Channel Logout URI setting, SessionGuard's endpoint is `https://guacamole.example.org/_sessionguard/auth/backchannel-logout`.
 
-For browser-initiated logout SessionGuard uses the `end_session_endpoint` discovered from PocketID, removes the local session first, then returns to `logout_redirect_url`.
+For browser-initiated logout SessionGuard uses the `end_session_endpoint` discovered from PocketID, removes the local session first, sends `client_id` plus an `id_token_hint` when available, and then returns to `logout_redirect_url`.
 
 ## Traefik
 

docs/POCKET-ID-HILDEN.md

@@ -0,0 +1,101 @@
+# Pocket ID settings for the Hilden deployment
+
+There is one OIDC provider (`https://login.hilden.de`) and two relevant Pocket ID OIDC clients. SessionGuard v0.5.2 with this hotfix uses confidential Authorization Code clients with PKCE S256 and RP-initiated logout.
+
+## Client 1: Guacamole Director
+
+Use these settings in Pocket ID:
+
+- Name: `Guacamole Director`
+- Public Client: **OFF**
+- PKCE: **ON**
+- Client secret: **keep the existing secret**
+- Client start URL: `https://director.hilden.de`
+- Require re-authentication: **OFF** unless you intentionally want a fresh Pocket ID authentication on every authorization
+- Skip consent screen: optional; it does not affect PKCE or logout
+- Federated Client Credentials: **not required** for SessionGuard's browser login; remove them unless another workload intentionally uses them
+
+Callback URLs:
+
+- `https://director.hilden.de/oidc/callback`
+- `https://gts01.hilden.de:9091/oidc/callback`
+- `https://gts02.hilden.de:9091/oidc/callback`
+- `https://gts03.hilden.de:9091/oidc/callback`
+
+Logout Callback URLs (Pocket ID allow-list for `post_logout_redirect_uri`):
+
+- `https://director.hilden.de/`
+- `https://gts01.hilden.de:9091/`
+- `https://gts02.hilden.de:9091/`
+- `https://gts03.hilden.de:9091/`
+
+The SessionGuard instance must use the callback/logout pair for the hostname through which that instance is opened. Example for the Director URL:
+
+```json
+"oidc": {
+  "issuer": "https://login.hilden.de",
+  "client_id": "307fde28-7d87-4671-9c7a-201d2332a617",
+  "client_secret": "SET-BY-SESSIONGUARD_OIDC_CLIENT_SECRET",
+  "redirect_url": "https://director.hilden.de/oidc/callback",
+  "logout_redirect_url": "https://director.hilden.de/",
+  "admin_groups": [],
+  "secure_cookie": true
+}
+```
+
+For a directly opened agent UI, use its exact pair instead, e.g. `https://gts01.hilden.de:9091/oidc/callback` and `https://gts01.hilden.de:9091/`.
+
+## Client 2: Guacamole (portal)
+
+Use these settings in Pocket ID:
+
+- Name: `Guacamole`
+- Public Client: **OFF**
+- PKCE: **ON**
+- Client secret: **keep the existing secret**
+- Client start URL: `https://portal.hilden.de`
+- Require re-authentication: **OFF** unless explicitly desired
+- Skip consent screen: optional
+- Federated Client Credentials: **not required** for SessionGuard's browser login
+
+Callback URL used by SessionGuard:
+
+- `https://portal.hilden.de/_sessionguard/auth/oidc/callback`
+
+Logout Callback URL:
+
+- `https://portal.hilden.de/`
+
+SessionGuard configuration:
+
+```json
+"access_auth": {
+  "enabled": true,
+  "issuer": "https://login.hilden.de",
+  "client_id": "170f9724-2d12-45c4-8e6f-e1e559be4f72",
+  "client_secret": "SET-BY-SESSIONGUARD_ACCESS_OIDC_CLIENT_SECRET",
+  "redirect_url": "https://portal.hilden.de/_sessionguard/auth/oidc/callback",
+  "logout_redirect_url": "https://portal.hilden.de/",
+  "cookie_name": "sg_access_session",
+  "cookie_domain": "",
+  "secure_cookie": true,
+  "session_hours": 8,
+  "username_claim": "preferred_username",
+  "allowed_groups": [],
+  "allowed_hosts": ["portal.hilden.de"]
+}
+```
+
+If `https://guacauth.hilden.info/portals/guacamole/oauth2/callback` is no longer used by a separate native Guacamole OIDC integration, remove it from Pocket ID. Keep it only if that second integration is still actually in use.
+
+## Logout behavior in this hotfix
+
+Both SessionGuard flows discover Pocket ID's `end_session_endpoint`. On logout SessionGuard clears its local session and redirects the browser to Pocket ID with:
+
+- `client_id`
+- `id_token_hint` when a successful SessionGuard login supplied one
+- the configured and registered `post_logout_redirect_uri`
+
+For the Director/Admin/Agent flow the hotfix retains the ID token server-side for the lifetime of the local browser session so it can be supplied as `id_token_hint` without placing the raw ID token in a browser cookie.
+
+The existing SessionGuard `/auth/backchannel-logout` handler is separate from the browser post-logout redirect. Do not enter that endpoint as the normal browser Logout Callback URL unless your Pocket ID version/integration explicitly provides a dedicated back-channel logout setting and calls it as such.