OIDC Back-Channel Logout Support for Clustered Servers

[SnapPetal]

Expected Behavior

The OidcSessionInformation class should include a mixin for JSON serialization to Redis, which will support clustered servers with OIDC back-channel logout enabled.

Current Behavior

Only the InMemoryOidcSessionRegistry is permitted, and it does not support OIDC back-channel logout for clustered servers that use Redis session storage in Spring Security.

Context

[franticticktick]

Hi @SnapPetal , this ticket is mostly a duplicate of 14511. In short, we will not be able to connect the oidc session with the client session, they work differently. Therefore, this cannot be included in the spring session. At the same time, it makes sense to implement JdbcOidcSessionRegistry within the framework of spring security. This can be quite a time consuming task and the community will thank you so much if you open a PR :)
For redis based implementation, the easiest way is to make a simple implementation, for example, OidcSessionRegistryImpl, together with spring cache, this way you can achieve the behavior you need.

[SnapPetal]

@franticticktick I am confused about OidcSessionRegistryImpl would work? Also how does OIDC Session and Spring Security work togethor?