Release/4.5.0

.env.example

@@ -29,9 +29,11 @@ BROADCAST_CONNECTION=log
 CACHE_STORE=file
 FILESYSTEM_DISK=local
 QUEUE_CONNECTION=sync
-SESSION_DRIVER=file
+# Session driver defaults to "database" in config/session.php (required by OIDC
+# Back-Channel Logout), so no SESSION_DRIVER entry is needed here.
 SESSION_LIFETIME=120
-SESSION_ENCRYPT=false
+# Session payload encryption defaults to "true" in config/session.php (the
+# payload carries authorization data); no SESSION_ENCRYPT entry is needed here.
 SESSION_PATH=/
 SESSION_DOMAIN=null
 
@@ -79,6 +81,8 @@ STUMV_CLIENT_SECRET=<your-secret-goes-here>
 STUMV_REDIRECT_URI=${APP_URL}/auth/callback
 # stumv host url including http(s) and a trailing /
 STUMV_HOST=https://stumv.de/
+# prefix for stumv's oauth-protected user/committees/groups api (moved from api to api-legacy)
+STUMV_API_PATH=api-legacy
 STUMV_LOGOUT_PATH=logout
 # note the demo realm, make sure to fix it to your relam, all empty groups will not be re-mapped
 # equivalent to login stufis group
@@ -100,10 +104,22 @@ OIDC_CLIENT_ID=
 OIDC_CLIENT_SECRET=
 # URL to OIDC discovery page, often ends with .../.well-known/openid-configuration, you need everything before that
 OIDC_PROVIDER_URL=https://your.keycloak.com/realms/user
-OIDC_SCOPES='profile email committees groups all-committees'
+OIDC_SCOPES='profile email committees groups'
 # OIDC optional parameters
 OIDC_CERT_PATH=
 OIDC_VERIFY_HOST=true# default: true
+# RP-Initiated Logout: logout redirects the user to the IdP's end_session_endpoint
+# (auto-discovered), which ends the SSO session and returns to the URL below.
+# Defaults to StuFis's own login route; if set, register the value as the client's
+# post_logout_redirect_uri in the IdP.
+OIDC_POST_LOGOUT_REDIRECT=
+# Whether the IdP shows its "really log out?" confirmation prompt (id_token_hint
+# is withheld). Default true, so the user confirms before their whole SSO session
+# ends. Set to false for a seamless logout without a prompt.
+OIDC_LOGOUT_CONFIRM=true
+# Back-Channel Logout: register "<APP_URL>/auth/backchannel-logout" as this
+# client's back_channel_logout_uri in the IdP so single-logout reaches StuFis.
+# Requires the database session driver (config/session.php). No env var needed here.
 # OIDC Group mapping,
 # a true value will give every authenticated user that priviege
 # an empty value will not remap the defaults
@@ -123,4 +139,3 @@ OIDC_ATTRIBUTE_IBAN=iban
 OIDC_ATTRIBUTE_ADDRESS=address
 OIDC_ATTRIBUTE_GROUP=groups
 OIDC_ATTRIBUTE_COMMITTEES=committees
-OIDC_ATTRIBUTE_ALL_COMMITTEES=all-committees