OpenID compliance check is not based on the final specification

[elythh]

Describe the bug

Hello 👋🏼
During the compliance check, RabbitMQ is currently looking for the end_session_endpoint argument[1]. However, this endpoint is not part of the final[2] specification but rather a draft[3].

[1]

rabbitmq-server/deps/rabbitmq_management/priv/www/js/oidc-oauth/helper.js

Line 269 in e610ada

throw new Error("Missing end_session_endpoint")

[2] https://openid.net/specs/openid-connect-session-1_0.html
[3] https://openid.net/specs/openid-connect-session-1_0-17.html

Reproduction steps

1. Configure rabbitmq with Auth0 as oauth2 provider
2. Try to log into your app
3. Get prompted with bad compliance

Expected behavior

This check should not be part of the compliance check.

Additional context

For anyone else having the same issue with 3.13.x, you can still manually enable that endpoint discovery following this documentation

EDIT: Any reason why the previous one got delete ? https://github.com/rabbitmq/rabbitmq-server/issues/10969

[michaelklishin]

@elythh there is a very specific reason why it was deleted: it was moved to a discussed and answered #10972 (comment).

[michaelklishin]

I don't have anything to add to #10972 (comment). Unless this becomes problematic for paying users, there are no plans to change anything besides adding a doc note to the Auth0 example. This is not an issue for other identity providers either.

Our team does not use issues for discussions => this will be locked.

[michaelklishin]

FTR, we have encountered a similar complaint from a paying user and here is the current (very brief) change plan: #11067.

[michaelklishin]

And rabbitmq/rabbitmq-website#1893 is the docs part.