Fix OIDC single sign-out breaking due to SameSite cookie changes in Moodle core

[Lai Wei (weilai-irl)]

No description provided.

[Copilot]

Pull request overview

This PR updates the OIDC single sign-out implementation to remain functional when the IdP-initiated logout request no longer includes the user’s MoodleSession cookie (e.g., due to Moodle core SameSite cookie changes). It does this by persisting the Moodle session ID at login time, then using it to terminate the correct session during logout, and by adjusting SID cleanup to be based on session existence instead of record age.

Changes:

• Store the active Moodle session ID alongside the IdP sid mapping at login time.
• Update the logout endpoint to terminate sessions directly (instead of relying on $USER / cookies).
• Add schema/upgrade/test/privacy updates for the new sessionid field and revised cleanup behavior.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
auth/oidc/version.php	Bumps plugin version to ship the change (currently uses a decimal version literal).
auth/oidc/classes/loginflow/authcode.php	Stores session_id() into the OIDC SID mapping during login.
auth/oidc/logout.php	Uses stored sessionid to destroy sessions on IdP-initiated logout.
auth/oidc/classes/task/cleanup_oidc_sid.php	Changes cleanup logic to delete mappings when the corresponding Moodle session no longer exists.
auth/oidc/tests/task/cleanup_oidc_sid_test.php	Updates unit test to validate cleanup based on session existence.
auth/oidc/db/install.xml	Adds sessionid field to auth_oidc_sid table definition.
auth/oidc/db/upgrade.php	Adds upgrade step to add the sessionid field on upgrade.
auth/oidc/classes/privacy/provider.php	Adds sessionid to privacy metadata.
auth/oidc/lang/en/auth_oidc.php	Adds language string for the new privacy metadata field.

Suppressed comments (1)

auth/oidc/db/upgrade.php:600

• The savepoint version should also be an integer (YYYYMMDDXX) matching $plugin->version; using a float here can confuse Moodle's plugin upgrade tracking.

        upgrade_plugin_savepoint(true, 2025040830.06, 'auth', 'oidc');

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.