Fix OIDC single sign-out breaking due to SameSite cookie changes in Moodle core

[Lai Wei (weilai-irl)]

No description provided.

[Copilot]

Pull request overview

This PR updates the auth_oidc plugin’s single logout (SLO) implementation so it can terminate the correct Moodle session even when the IdP’s logout request no longer includes the user’s MoodleSession cookie (e.g., due to SameSite behavior changes).

Changes:

• Persist the Moodle session id alongside the OIDC sid mapping at login time and destroy that session during SLO.
• Change the scheduled cleanup task to remove auth_oidc_sid mappings based on Moodle session existence (instead of age).
• Add DB schema + privacy metadata for the new sessionid field and update unit tests accordingly.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
auth/oidc/version.php	Bumps plugin version (currently using a float).
auth/oidc/classes/loginflow/authcode.php	Stores the current Moodle session id when creating the OIDC sid mapping.
auth/oidc/logout.php	Uses the stored session id to destroy the correct session during IdP-initiated logout.
auth/oidc/classes/task/cleanup_oidc_sid.php	Cleans up auth_oidc_sid mappings by checking whether the linked Moodle session still exists.
auth/oidc/tests/task/cleanup_oidc_sid_test.php	Updates tests to validate cleanup behavior based on session existence.
auth/oidc/db/install.xml	Adds the sessionid column to the auth_oidc_sid table schema.
auth/oidc/db/upgrade.php	Adds the upgrade step to create the new sessionid column.
auth/oidc/classes/privacy/provider.php	Includes sessionid in privacy metadata export/delete handling.
auth/oidc/lang/en/auth_oidc.php	Adds the language string describing sessionid privacy metadata.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.