From 8b22189e9b6b052c73519c2307c3badb551d1c9f Mon Sep 17 00:00:00 2001
From: Bryan Vestey <bryan.vestey@onelogin.com>
Date: Mon, 28 Feb 2022 16:39:53 -0800
Subject: [PATCH 1/6] Initial code for sign out

---
 .../Base.lproj/Main.storyboard                | 67 ++++++++++------
 ios-oidc-swift-tester/ViewController.swift    | 11 +++
 ios-oidc/Oidc/OLOidc.swift                    | 76 +++++++++++++++++++
 ios-oidc/Oidc/OLOidcAuthState.swift           |  3 +
 ios-oidc/Oidc/OLOidcError.swift               |  3 +
 5 files changed, 138 insertions(+), 22 deletions(-)

diff --git a/ios-oidc-swift-tester/Base.lproj/Main.storyboard b/ios-oidc-swift-tester/Base.lproj/Main.storyboard
index ae9691b..e276686 100644
--- a/ios-oidc-swift-tester/Base.lproj/Main.storyboard
+++ b/ios-oidc-swift-tester/Base.lproj/Main.storyboard
@@ -1,9 +1,11 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<document type="com.apple.InterfaceBuilder3.CocoaTouch.Storyboard.XIB" version="3.0" toolsVersion="15505" targetRuntime="iOS.CocoaTouch" propertyAccessControl="none" useAutolayout="YES" useTraitCollections="YES" useSafeAreas="YES" colorMatched="YES" initialViewController="BYZ-38-t0r">
+<document type="com.apple.InterfaceBuilder3.CocoaTouch.Storyboard.XIB" version="3.0" toolsVersion="19529" targetRuntime="iOS.CocoaTouch" propertyAccessControl="none" useAutolayout="YES" useTraitCollections="YES" useSafeAreas="YES" colorMatched="YES" initialViewController="BYZ-38-t0r">
     <device id="retina6_5" orientation="portrait" appearance="light"/>
     <dependencies>
-        <plugIn identifier="com.apple.InterfaceBuilder.IBCocoaTouchPlugin" version="15510"/>
+        <deployment identifier="iOS"/>
+        <plugIn identifier="com.apple.InterfaceBuilder.IBCocoaTouchPlugin" version="19519"/>
         <capability name="Safe area layout guides" minToolsVersion="9.0"/>
+        <capability name="System colors in document resources" minToolsVersion="11.0"/>
         <capability name="documents saved in the Xcode 8 format" minToolsVersion="8.0"/>
     </dependencies>
     <scenes>
@@ -16,12 +18,12 @@
                         <autoresizingMask key="autoresizingMask" widthSizable="YES" heightSizable="YES"/>
                         <subviews>
                             <stackView opaque="NO" contentMode="scaleToFill" axis="vertical" spacing="20" translatesAutoresizingMaskIntoConstraints="NO" id="rxM-TH-U9A">
-                                <rect key="frame" x="20.666666666666657" y="100.33333333333331" width="372.66666666666674" height="695.33333333333348"/>
+                                <rect key="frame" x="20.666666666666657" y="121.33333333333331" width="372.66666666666674" height="653.33333333333348"/>
                                 <subviews>
                                     <stackView opaque="NO" contentMode="scaleToFill" axis="vertical" distribution="fillProportionally" spacing="2" translatesAutoresizingMaskIntoConstraints="NO" id="eRe-zk-tn6">
-                                        <rect key="frame" x="0.0" y="0.0" width="372.66666666666669" height="126"/>
+                                        <rect key="frame" x="0.0" y="0.0" width="372.66666666666669" height="158"/>
                                         <subviews>
-                                            <button opaque="NO" contentMode="scaleToFill" contentHorizontalAlignment="center" contentVerticalAlignment="center" buttonType="roundedRect" lineBreakMode="middleTruncation" translatesAutoresizingMaskIntoConstraints="NO" id="6TA-kl-cNi">
+                                            <button opaque="NO" contentMode="scaleToFill" contentHorizontalAlignment="center" contentVerticalAlignment="center" buttonType="system" lineBreakMode="middleTruncation" translatesAutoresizingMaskIntoConstraints="NO" id="6TA-kl-cNi">
                                                 <rect key="frame" x="0.0" y="0.0" width="372.66666666666669" height="30"/>
                                                 <color key="backgroundColor" red="0.0" green="0.46666666670000001" blue="0.61960784310000006" alpha="1" colorSpace="calibratedRGB"/>
                                                 <state key="normal" title="Sign In">
@@ -36,8 +38,19 @@
                                                     <action selector="btnSignInClicked:" destination="BYZ-38-t0r" eventType="touchUpInside" id="5em-mZ-o7c"/>
                                                 </connections>
                                             </button>
-                                            <button opaque="NO" contentMode="scaleToFill" contentHorizontalAlignment="center" contentVerticalAlignment="center" buttonType="roundedRect" lineBreakMode="middleTruncation" translatesAutoresizingMaskIntoConstraints="NO" id="7Vv-Xj-ONh">
+                                            <button opaque="NO" contentMode="scaleToFill" contentHorizontalAlignment="center" contentVerticalAlignment="center" buttonType="system" lineBreakMode="middleTruncation" translatesAutoresizingMaskIntoConstraints="NO" id="PBy-1I-i8X">
                                                 <rect key="frame" x="0.0" y="32.000000000000014" width="372.66666666666669" height="30"/>
+                                                <color key="backgroundColor" red="0.0" green="0.54190033670000004" blue="0.68055230379999998" alpha="1" colorSpace="custom" customColorSpace="sRGB"/>
+                                                <inset key="imageEdgeInsets" minX="0.0" minY="0.0" maxX="2.2250738585072014e-308" maxY="0.0"/>
+                                                <state key="normal" title="Sign Out">
+                                                    <color key="titleColor" red="0.91813594099999996" green="0.95243209600000001" blue="0.96607035399999996" alpha="1" colorSpace="custom" customColorSpace="sRGB"/>
+                                                </state>
+                                                <connections>
+                                                    <action selector="btnSignOutClicked:" destination="BYZ-38-t0r" eventType="touchUpInside" id="WGr-jG-Ozb"/>
+                                                </connections>
+                                            </button>
+                                            <button opaque="NO" contentMode="scaleToFill" contentHorizontalAlignment="center" contentVerticalAlignment="center" buttonType="system" lineBreakMode="middleTruncation" translatesAutoresizingMaskIntoConstraints="NO" id="7Vv-Xj-ONh">
+                                                <rect key="frame" x="0.0" y="64.000000000000014" width="372.66666666666669" height="30"/>
                                                 <color key="backgroundColor" red="0.0" green="0.46666666670000001" blue="0.61960784310000006" alpha="1" colorSpace="calibratedRGB"/>
                                                 <state key="normal" title="Introspect">
                                                     <color key="titleColor" red="0.96862745100000003" green="0.97647058819999999" blue="0.98039215690000003" alpha="1" colorSpace="custom" customColorSpace="sRGB"/>
@@ -51,8 +64,8 @@
                                                     <action selector="btnIntrospectClicked:" destination="BYZ-38-t0r" eventType="touchUpInside" id="DIC-vO-n5r"/>
                                                 </connections>
                                             </button>
-                                            <button opaque="NO" contentMode="scaleToFill" contentHorizontalAlignment="center" contentVerticalAlignment="center" buttonType="roundedRect" lineBreakMode="middleTruncation" translatesAutoresizingMaskIntoConstraints="NO" id="2Ez-aE-xP8">
-                                                <rect key="frame" x="0.0" y="64.000000000000014" width="372.66666666666669" height="30"/>
+                                            <button opaque="NO" contentMode="scaleToFill" contentHorizontalAlignment="center" contentVerticalAlignment="center" buttonType="system" lineBreakMode="middleTruncation" translatesAutoresizingMaskIntoConstraints="NO" id="2Ez-aE-xP8">
+                                                <rect key="frame" x="0.0" y="96.000000000000014" width="372.66666666666669" height="30"/>
                                                 <color key="backgroundColor" red="0.0" green="0.46666666670000001" blue="0.61960784310000006" alpha="1" colorSpace="calibratedRGB"/>
                                                 <state key="normal" title="Get User-Info">
                                                     <color key="titleColor" red="0.96862745100000003" green="0.97647058819999999" blue="0.98039215690000003" alpha="1" colorSpace="custom" customColorSpace="sRGB"/>
@@ -66,8 +79,8 @@
                                                     <action selector="btnGetUserInfoClicked:" destination="BYZ-38-t0r" eventType="touchUpInside" id="SoB-TR-rsc"/>
                                                 </connections>
                                             </button>
-                                            <button opaque="NO" contentMode="scaleToFill" contentHorizontalAlignment="center" contentVerticalAlignment="center" buttonType="roundedRect" lineBreakMode="middleTruncation" translatesAutoresizingMaskIntoConstraints="NO" id="ZgE-Nx-zeA" userLabel="Refresh access token">
-                                                <rect key="frame" x="0.0" y="96.000000000000014" width="372.66666666666669" height="30"/>
+                                            <button opaque="NO" contentMode="scaleToFill" contentHorizontalAlignment="center" contentVerticalAlignment="center" buttonType="system" lineBreakMode="middleTruncation" translatesAutoresizingMaskIntoConstraints="NO" id="ZgE-Nx-zeA" userLabel="Refresh access token">
+                                                <rect key="frame" x="0.0" y="128" width="372.66666666666669" height="30"/>
                                                 <color key="backgroundColor" red="0.0" green="0.46666666670000001" blue="0.61960784310000006" alpha="1" colorSpace="calibratedRGB"/>
                                                 <state key="normal" title="Refresh access token">
                                                     <color key="titleColor" red="0.96862745100000003" green="0.97647058819999999" blue="0.98039215690000003" alpha="1" colorSpace="custom" customColorSpace="sRGB"/>
@@ -84,9 +97,9 @@
                                         </subviews>
                                     </stackView>
                                     <stackView opaque="NO" contentMode="scaleToFill" axis="vertical" distribution="fillProportionally" spacing="2" translatesAutoresizingMaskIntoConstraints="NO" id="eDp-eE-cgm">
-                                        <rect key="frame" x="0.0" y="146" width="372.66666666666669" height="94"/>
+                                        <rect key="frame" x="0.0" y="178" width="372.66666666666669" height="94"/>
                                         <subviews>
-                                            <button opaque="NO" contentMode="scaleToFill" contentHorizontalAlignment="center" contentVerticalAlignment="center" buttonType="roundedRect" lineBreakMode="middleTruncation" translatesAutoresizingMaskIntoConstraints="NO" id="8NK-P1-M9j">
+                                            <button opaque="NO" contentMode="scaleToFill" contentHorizontalAlignment="center" contentVerticalAlignment="center" buttonType="system" lineBreakMode="middleTruncation" translatesAutoresizingMaskIntoConstraints="NO" id="8NK-P1-M9j">
                                                 <rect key="frame" x="0.0" y="0.0" width="372.66666666666669" height="30"/>
                                                 <color key="backgroundColor" red="0.0" green="0.46666666670000001" blue="0.61960784310000006" alpha="1" colorSpace="calibratedRGB"/>
                                                 <state key="normal" title="Delete Tokens">
@@ -101,8 +114,8 @@
                                                     <action selector="btnDeleteTokensClicked:" destination="BYZ-38-t0r" eventType="touchUpInside" id="Z9u-Fx-mXo"/>
                                                 </connections>
                                             </button>
-                                            <button opaque="NO" contentMode="scaleToFill" contentHorizontalAlignment="center" contentVerticalAlignment="center" buttonType="roundedRect" lineBreakMode="middleTruncation" translatesAutoresizingMaskIntoConstraints="NO" id="47H-La-B1Z">
-                                                <rect key="frame" x="0.0" y="31.999999999999972" width="372.66666666666669" height="30"/>
+                                            <button opaque="NO" contentMode="scaleToFill" contentHorizontalAlignment="center" contentVerticalAlignment="center" buttonType="system" lineBreakMode="middleTruncation" translatesAutoresizingMaskIntoConstraints="NO" id="47H-La-B1Z">
+                                                <rect key="frame" x="0.0" y="32" width="372.66666666666669" height="30"/>
                                                 <color key="backgroundColor" red="0.0" green="0.46666666670000001" blue="0.61960784310000006" alpha="1" colorSpace="calibratedRGB"/>
                                                 <state key="normal" title="Revoke Access-Token">
                                                     <color key="titleColor" red="0.96862745100000003" green="0.97647058819999999" blue="0.98039215690000003" alpha="1" colorSpace="custom" customColorSpace="sRGB"/>
@@ -116,8 +129,8 @@
                                                     <action selector="btnRevokeAccessTokenClicked:" destination="BYZ-38-t0r" eventType="touchUpInside" id="CBb-iD-ICQ"/>
                                                 </connections>
                                             </button>
-                                            <button opaque="NO" contentMode="scaleToFill" contentHorizontalAlignment="center" contentVerticalAlignment="center" buttonType="roundedRect" lineBreakMode="middleTruncation" translatesAutoresizingMaskIntoConstraints="NO" id="2ye-ua-MeM">
-                                                <rect key="frame" x="0.0" y="63.999999999999972" width="372.66666666666669" height="30"/>
+                                            <button opaque="NO" contentMode="scaleToFill" contentHorizontalAlignment="center" contentVerticalAlignment="center" buttonType="system" lineBreakMode="middleTruncation" translatesAutoresizingMaskIntoConstraints="NO" id="2ye-ua-MeM">
+                                                <rect key="frame" x="0.0" y="64" width="372.66666666666669" height="30"/>
                                                 <color key="backgroundColor" red="0.0" green="0.46666666670000001" blue="0.61960784310000006" alpha="1" colorSpace="calibratedRGB"/>
                                                 <state key="normal" title="Revoke Refresh-Token">
                                                     <color key="titleColor" red="0.96862745100000003" green="0.97647058819999999" blue="0.98039215690000003" alpha="1" colorSpace="custom" customColorSpace="sRGB"/>
@@ -134,30 +147,32 @@
                                         </subviews>
                                     </stackView>
                                     <label opaque="NO" userInteractionEnabled="NO" contentMode="left" horizontalHuggingPriority="251" verticalHuggingPriority="251" text="Info:" textAlignment="natural" lineBreakMode="tailTruncation" baselineAdjustment="alignBaselines" adjustsFontSizeToFit="NO" translatesAutoresizingMaskIntoConstraints="NO" id="1Ka-zb-bYE">
-                                        <rect key="frame" x="0.0" y="260" width="372.66666666666669" height="20.333333333333314"/>
+                                        <rect key="frame" x="0.0" y="292" width="372.66666666666669" height="20.333333333333314"/>
                                         <fontDescription key="fontDescription" type="system" pointSize="17"/>
                                         <nil key="textColor"/>
                                         <nil key="highlightedColor"/>
                                     </label>
                                     <textView clipsSubviews="YES" multipleTouchEnabled="YES" contentMode="scaleToFill" textAlignment="natural" translatesAutoresizingMaskIntoConstraints="NO" id="uax-kc-u0J">
-                                        <rect key="frame" x="0.0" y="300.33333333333337" width="372.66666666666669" height="395"/>
-                                        <color key="backgroundColor" systemColor="systemBackgroundColor" cocoaTouchSystemColor="whiteColor"/>
-                                        <color key="textColor" systemColor="labelColor" cocoaTouchSystemColor="darkTextColor"/>
+                                        <rect key="frame" x="0.0" y="332.33333333333337" width="372.66666666666669" height="321"/>
+                                        <color key="backgroundColor" systemColor="systemBackgroundColor"/>
+                                        <color key="textColor" systemColor="labelColor"/>
                                         <fontDescription key="fontDescription" type="system" pointSize="14"/>
                                         <textInputTraits key="textInputTraits" autocapitalizationType="sentences"/>
                                     </textView>
                                 </subviews>
                             </stackView>
                         </subviews>
-                        <color key="backgroundColor" systemColor="systemBackgroundColor" cocoaTouchSystemColor="whiteColor"/>
+                        <viewLayoutGuide key="safeArea" id="6Tk-OE-BBY"/>
+                        <color key="backgroundColor" systemColor="systemBackgroundColor"/>
                         <constraints>
                             <constraint firstItem="rxM-TH-U9A" firstAttribute="height" secondItem="6Tk-OE-BBY" secondAttribute="height" multiplier="0.85" id="41e-No-Dnk"/>
                             <constraint firstItem="rxM-TH-U9A" firstAttribute="centerY" secondItem="8bC-Xf-vdC" secondAttribute="centerY" id="UvQ-71-8Xg"/>
                             <constraint firstItem="rxM-TH-U9A" firstAttribute="width" secondItem="8bC-Xf-vdC" secondAttribute="width" multiplier="0.9" id="mYh-LQ-5yu"/>
                             <constraint firstItem="rxM-TH-U9A" firstAttribute="centerX" secondItem="8bC-Xf-vdC" secondAttribute="centerX" id="tQc-YT-2jl"/>
                         </constraints>
-                        <viewLayoutGuide key="safeArea" id="6Tk-OE-BBY"/>
                     </view>
+                    <toolbarItems/>
+                    <simulatedToolbarMetrics key="simulatedBottomBarMetrics"/>
                     <connections>
                         <outlet property="infoText" destination="uax-kc-u0J" id="Xbl-K0-oLa"/>
                     </connections>
@@ -167,4 +182,12 @@
             <point key="canvasLocation" x="132" y="139"/>
         </scene>
     </scenes>
+    <resources>
+        <systemColor name="labelColor">
+            <color white="0.0" alpha="1" colorSpace="custom" customColorSpace="genericGamma22GrayColorSpace"/>
+        </systemColor>
+        <systemColor name="systemBackgroundColor">
+            <color white="1" alpha="1" colorSpace="custom" customColorSpace="genericGamma22GrayColorSpace"/>
+        </systemColor>
+    </resources>
 </document>
diff --git a/ios-oidc-swift-tester/ViewController.swift b/ios-oidc-swift-tester/ViewController.swift
index c6e1c1f..cee366d 100644
--- a/ios-oidc-swift-tester/ViewController.swift
+++ b/ios-oidc-swift-tester/ViewController.swift
@@ -37,6 +37,17 @@ class ViewController: UIViewController {
         }
     }
     
+    @IBAction func btnSignOutClicked(_ sender: Any) {
+        olOidc?.signOut(callback: { success, error in
+            if let error = error {
+                self.setInfoText(text: error.localizedDescription)
+                return
+            }
+            let status = success ? "Sign out is successful" : "Signout failed"
+            self.setInfoText(text: status)
+        })
+    }
+    
     @IBAction func btnIntrospectClicked(_ sender: Any) {
         olOidc?.introspect(callback: { (tokenValid, error) in
             if let error = error {
diff --git a/ios-oidc/Oidc/OLOidc.swift b/ios-oidc/Oidc/OLOidc.swift
index 8a2ee3d..22e7efa 100644
--- a/ios-oidc/Oidc/OLOidc.swift
+++ b/ios-oidc/Oidc/OLOidc.swift
@@ -73,6 +73,82 @@ public class OLOidc: NSObject {
         olAuthState.authState = nil
     }
     
+    @objc public func signOut(callback: @escaping ((Bool, Error?) -> Void)) {
+        guard let signOutEndpoint = self.olAuthState.endSessionEndpoint else {
+            callback(false, OLOidcError.endSessionEndpointUndeclared)
+            return
+        }
+        
+        self.olAuthState.authState?.performAction() { (accessToken, idToken, error) in
+
+            if error != nil  {
+                callback(false, OLOidcError.fetchingFreshTokenError(error?.localizedDescription ?? "Unknown error"))
+                return
+            }
+
+            guard let accessToken = accessToken else {
+                callback(false, OLOidcError.gettingAccessTokenError)
+                return
+            }
+            
+            var urlRequest = URLRequest(url: signOutEndpoint)
+            urlRequest.allHTTPHeaderFields = ["Authorization":"Bearer \(accessToken)"]
+
+            let task = URLSession.shared.dataTask(with: urlRequest) { data, response, error in
+
+                DispatchQueue.main.async {
+                    
+                    guard error == nil else {
+                        callback(false, OLOidcError.httpRequestFailed(error?.localizedDescription ?? "Unknown error"))
+                        return
+                    }
+
+                    guard let response = response as? HTTPURLResponse else {
+                        callback(false, OLOidcError.nonHttpResponse)
+                        return
+                    }
+
+                    if response.statusCode != 302 {
+                        guard let data = data else {
+                            callback(false, OLOidcError.noResponseData)
+                            return
+                        }
+                        
+                        var json: [AnyHashable: Any]?
+
+                        do {
+                            json = try JSONSerialization.jsonObject(with: data, options: []) as? [String: Any]
+                        } catch {
+                            callback(false, OLOidcError.jsonSerializationError)
+                            return
+                        }
+                        
+                        // server replied with an error
+                        let responseText: String? = String(data: data, encoding: String.Encoding.utf8)
+
+                        if response.statusCode == 401 {
+                            // "401 Unauthorized" generally indicates there is an issue with the authorization
+                            // grant. Puts OIDAuthState into an error state.
+                            let oauthError = OIDErrorUtilities.resourceServerAuthorizationError(withCode: 0,
+                                                                                                errorResponse: json,
+                                                                                                underlyingError: error)
+                            self.olAuthState.authState?.update(withAuthorizationError: oauthError)
+                            callback(false, OLOidcError.authorizationError("(\(oauthError)). Response: \(responseText ?? "RESPONSE_TEXT")"))
+                        } else {
+                            callback(false, OLOidcError.authorizationError("(\(response.statusCode)). Response: \(responseText ?? "RESPONSE_TEXT")"))
+                        }
+
+                        return
+                    }
+                    
+                    callback(true, nil)
+                }
+            }
+            
+            task.resume()
+        }
+    }
+    
     @objc public func revokeToken(tokenType: TokenType, callback: @escaping ((Error?) -> Void)) {
         guard let tokenEndpoint = self.olAuthState.tokenEndpoint else {
             callback(OLOidcError.tokenEndpointUndeclared)
diff --git a/ios-oidc/Oidc/OLOidcAuthState.swift b/ios-oidc/Oidc/OLOidcAuthState.swift
index cff377f..543ba27 100644
--- a/ios-oidc/Oidc/OLOidcAuthState.swift
+++ b/ios-oidc/Oidc/OLOidcAuthState.swift
@@ -32,6 +32,9 @@ open class OLOidcAuthState: NSObject {
     @objc open var refreshToken: String? {
         get {return authState?.lastTokenResponse?.refreshToken}
     }
+    @objc open var endSessionEndpoint: URL? {
+        get {return authState?.lastAuthorizationResponse.request.configuration.discoveryDocument?.endSessionEndpoint}
+    }
     @objc open var tokenEndpoint: URL? {
         get {return authState?.lastAuthorizationResponse.request.configuration.discoveryDocument?.tokenEndpoint}
     }
diff --git a/ios-oidc/Oidc/OLOidcError.swift b/ios-oidc/Oidc/OLOidcError.swift
index af757ac..8475dea 100644
--- a/ios-oidc/Oidc/OLOidcError.swift
+++ b/ios-oidc/Oidc/OLOidcError.swift
@@ -12,6 +12,7 @@ public enum OLOidcError: Error, Equatable {
     case configFileParseFailure
     case configInvalid
     case missingConfiguration
+    case endSessionEndpointUndeclared
     case tokenEndpointUndeclared
     case userEndpointUndeclared
     case fetchingFreshTokenError(String)
@@ -35,6 +36,8 @@ extension OLOidcError: LocalizedError {
             return "No configuration was provided to OLOidc."
         case .configInvalid:
             return "The config file contains invalid parameters."
+        case .endSessionEndpointUndeclared:
+            return "End session endpoint not declared in discovery document."
         case .tokenEndpointUndeclared:
             return "Token endpoint not declared in discovery document."
         case .userEndpointUndeclared:

From 67f659017946522e23ba8aba33edb12ad3735651 Mon Sep 17 00:00:00 2001
From: Bryan Vestey <bryan.vestey@onelogin.com>
Date: Tue, 1 Mar 2022 14:21:49 -0800
Subject: [PATCH 2/6] Updated to use id_token_hint

---
 ios-oidc/Oidc/OLOidc.swift      | 12 ++++++++----
 ios-oidc/Oidc/OLOidcError.swift |  6 ++++++
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/ios-oidc/Oidc/OLOidc.swift b/ios-oidc/Oidc/OLOidc.swift
index 22e7efa..7ff68d9 100644
--- a/ios-oidc/Oidc/OLOidc.swift
+++ b/ios-oidc/Oidc/OLOidc.swift
@@ -86,13 +86,17 @@ public class OLOidc: NSObject {
                 return
             }
 
-            guard let accessToken = accessToken else {
-                callback(false, OLOidcError.gettingAccessTokenError)
+            guard let idToken = idToken else {
+                callback(false, OLOidcError.gettingIdTokenError)
                 return
             }
             
-            var urlRequest = URLRequest(url: signOutEndpoint)
-            urlRequest.allHTTPHeaderFields = ["Authorization":"Bearer \(accessToken)"]
+            guard let url = URL(string: "\(signOutEndpoint.absoluteString)?id_token_hint=\(idToken)") else {
+                callback(false, OLOidcError.generatingSignOutUrlError)
+                return
+            }
+
+            let urlRequest = URLRequest(url: url)
 
             let task = URLSession.shared.dataTask(with: urlRequest) { data, response, error in
 
diff --git a/ios-oidc/Oidc/OLOidcError.swift b/ios-oidc/Oidc/OLOidcError.swift
index 8475dea..b25ccfb 100644
--- a/ios-oidc/Oidc/OLOidcError.swift
+++ b/ios-oidc/Oidc/OLOidcError.swift
@@ -17,6 +17,8 @@ public enum OLOidcError: Error, Equatable {
     case userEndpointUndeclared
     case fetchingFreshTokenError(String)
     case gettingAccessTokenError
+    case gettingIdTokenError
+    case generatingSignOutUrlError
     case httpRequestFailed(String)
     case nonHttpResponse
     case noResponseData
@@ -46,6 +48,10 @@ extension OLOidcError: LocalizedError {
             return "Error fetching fresh tokens: \(error)"
         case .gettingAccessTokenError:
             return "Error getting accessToken"
+        case .gettingIdTokenError:
+            return "Error getting idToken"
+        case .generatingSignOutUrlError:
+            return "Error generating URL for signing out"
         case .httpRequestFailed(error: let error):
             return "HTTP request failed \(error)"
         case .nonHttpResponse:

From 1199552501256bb2e36f4a63bb8c5afdfbd9449d Mon Sep 17 00:00:00 2001
From: Bryan Vestey <bryan.vestey@onelogin.com>
Date: Thu, 3 Mar 2022 17:30:36 -0800
Subject: [PATCH 3/6] Gett logout code working

---
 ios-oidc/Oidc/OLOidc.swift | 23 ++++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

diff --git a/ios-oidc/Oidc/OLOidc.swift b/ios-oidc/Oidc/OLOidc.swift
index 7ff68d9..be88801 100644
--- a/ios-oidc/Oidc/OLOidc.swift
+++ b/ios-oidc/Oidc/OLOidc.swift
@@ -13,6 +13,19 @@ import Foundation
     case RefreshToken = 1
 }
 
+private class RedirectDelegate: NSObject, URLSessionTaskDelegate {
+    func urlSession(
+        _: URLSession,
+        task: URLSessionTask,
+        willPerformHTTPRedirection: HTTPURLResponse,
+        newRequest: URLRequest,
+        completionHandler: (URLRequest?) -> Void
+    ) {
+        // Stops the redirection, and returns (internally) the response body.
+        completionHandler(nil)
+    }
+}
+
 public class OLOidc: NSObject {
     
     @objc public let oidcConfig: OLOidcConfig
@@ -91,15 +104,15 @@ public class OLOidc: NSObject {
                 return
             }
             
+            // guard let url = URL(string: "\(signOutEndpoint.absoluteString)?post_logout_redirect_uri=https://vestey-dev.onelogin-shadow01.com&id_token_hint=\(idToken)")
             guard let url = URL(string: "\(signOutEndpoint.absoluteString)?id_token_hint=\(idToken)") else {
                 callback(false, OLOidcError.generatingSignOutUrlError)
                 return
             }
-
+            
+            let session = URLSession(configuration: URLSessionConfiguration.default, delegate: RedirectDelegate(), delegateQueue: nil)
             let urlRequest = URLRequest(url: url)
-
-            let task = URLSession.shared.dataTask(with: urlRequest) { data, response, error in
-
+            let task = session.dataTask(with: urlRequest) { data, response, error in
                 DispatchQueue.main.async {
                     
                     guard error == nil else {
@@ -112,7 +125,7 @@ public class OLOidc: NSObject {
                         return
                     }
 
-                    if response.statusCode != 302 {
+                    if response.statusCode > 302 {
                         guard let data = data else {
                             callback(false, OLOidcError.noResponseData)
                             return

From 1ba453c760dab4f4be80dcf3f108bed26cf32f8b Mon Sep 17 00:00:00 2001
From: Bryan Vestey <bryan.vestey@onelogin.com>
Date: Thu, 10 Mar 2022 11:45:56 -0800
Subject: [PATCH 4/6] Clean up logout path to clear token, still has UX
 issues...

---
 .../Base.lproj/Main.storyboard                |  5 +
 ios-oidc-swift-tester/ViewController.swift    |  7 +-
 ios-oidc/Oidc/OLOidc.swift                    | 99 +++++++------------
 3 files changed, 41 insertions(+), 70 deletions(-)

diff --git a/ios-oidc-swift-tester/Base.lproj/Main.storyboard b/ios-oidc-swift-tester/Base.lproj/Main.storyboard
index e276686..7c6ccb5 100644
--- a/ios-oidc-swift-tester/Base.lproj/Main.storyboard
+++ b/ios-oidc-swift-tester/Base.lproj/Main.storyboard
@@ -45,6 +45,11 @@
                                                 <state key="normal" title="Sign Out">
                                                     <color key="titleColor" red="0.91813594099999996" green="0.95243209600000001" blue="0.96607035399999996" alpha="1" colorSpace="custom" customColorSpace="sRGB"/>
                                                 </state>
+                                                <userDefinedRuntimeAttributes>
+                                                    <userDefinedRuntimeAttribute type="number" keyPath="layer.cornerRadius">
+                                                        <integer key="value" value="15"/>
+                                                    </userDefinedRuntimeAttribute>
+                                                </userDefinedRuntimeAttributes>
                                                 <connections>
                                                     <action selector="btnSignOutClicked:" destination="BYZ-38-t0r" eventType="touchUpInside" id="WGr-jG-Ozb"/>
                                                 </connections>
diff --git a/ios-oidc-swift-tester/ViewController.swift b/ios-oidc-swift-tester/ViewController.swift
index cee366d..69af6e6 100644
--- a/ios-oidc-swift-tester/ViewController.swift
+++ b/ios-oidc-swift-tester/ViewController.swift
@@ -38,14 +38,13 @@ class ViewController: UIViewController {
     }
     
     @IBAction func btnSignOutClicked(_ sender: Any) {
-        olOidc?.signOut(callback: { success, error in
+        olOidc?.signOut(presenter: self) { error in
             if let error = error {
                 self.setInfoText(text: error.localizedDescription)
                 return
             }
-            let status = success ? "Sign out is successful" : "Signout failed"
-            self.setInfoText(text: status)
-        })
+            self.setInfoText(text: "Sign out is successful")
+        }
     }
     
     @IBAction func btnIntrospectClicked(_ sender: Any) {
diff --git a/ios-oidc/Oidc/OLOidc.swift b/ios-oidc/Oidc/OLOidc.swift
index be88801..4a3081d 100644
--- a/ios-oidc/Oidc/OLOidc.swift
+++ b/ios-oidc/Oidc/OLOidc.swift
@@ -7,6 +7,8 @@
 //
 
 import Foundation
+import WebKit
+import SafariServices
 
 @objc public enum TokenType: Int {
     case AccessToken = 0
@@ -26,6 +28,12 @@ private class RedirectDelegate: NSObject, URLSessionTaskDelegate {
     }
 }
 
+private class CloseSafariOnOpen: NSObject, SFSafariViewControllerDelegate {
+    public func safariViewController(_ controller: SFSafariViewController, didCompleteInitialLoad didLoadSuccessfully: Bool) {
+        controller.dismiss(animated: false)
+    }
+}
+
 public class OLOidc: NSObject {
     
     @objc public let oidcConfig: OLOidcConfig
@@ -85,84 +93,43 @@ public class OLOidc: NSObject {
     @objc public func deleteTokens() {
         olAuthState.authState = nil
     }
-    
-    @objc public func signOut(callback: @escaping ((Bool, Error?) -> Void)) {
-        guard let signOutEndpoint = self.olAuthState.endSessionEndpoint else {
-            callback(false, OLOidcError.endSessionEndpointUndeclared)
-            return
-        }
-        
-        self.olAuthState.authState?.performAction() { (accessToken, idToken, error) in
 
+    @objc public func signOut(presenter: UIViewController, callback: @escaping ((Error?) -> Void)) {
+        self.olAuthState.authState?.performAction() { (accessToken, idToken, error) in
             if error != nil  {
-                callback(false, OLOidcError.fetchingFreshTokenError(error?.localizedDescription ?? "Unknown error"))
+                callback(OLOidcError.fetchingFreshTokenError(error?.localizedDescription ?? "Unknown error"))
                 return
             }
 
             guard let idToken = idToken else {
-                callback(false, OLOidcError.gettingIdTokenError)
-                return
-            }
-            
-            // guard let url = URL(string: "\(signOutEndpoint.absoluteString)?post_logout_redirect_uri=https://vestey-dev.onelogin-shadow01.com&id_token_hint=\(idToken)")
-            guard let url = URL(string: "\(signOutEndpoint.absoluteString)?id_token_hint=\(idToken)") else {
-                callback(false, OLOidcError.generatingSignOutUrlError)
+                callback(OLOidcError.gettingIdTokenError)
                 return
             }
-            
-            let session = URLSession(configuration: URLSessionConfiguration.default, delegate: RedirectDelegate(), delegateQueue: nil)
-            let urlRequest = URLRequest(url: url)
-            let task = session.dataTask(with: urlRequest) { data, response, error in
-                DispatchQueue.main.async {
-                    
-                    guard error == nil else {
-                        callback(false, OLOidcError.httpRequestFailed(error?.localizedDescription ?? "Unknown error"))
-                        return
-                    }
-
-                    guard let response = response as? HTTPURLResponse else {
-                        callback(false, OLOidcError.nonHttpResponse)
-                        return
-                    }
 
-                    if response.statusCode > 302 {
-                        guard let data = data else {
-                            callback(false, OLOidcError.noResponseData)
-                            return
-                        }
-                        
-                        var json: [AnyHashable: Any]?
-
-                        do {
-                            json = try JSONSerialization.jsonObject(with: data, options: []) as? [String: Any]
-                        } catch {
-                            callback(false, OLOidcError.jsonSerializationError)
-                            return
-                        }
-                        
-                        // server replied with an error
-                        let responseText: String? = String(data: data, encoding: String.Encoding.utf8)
-
-                        if response.statusCode == 401 {
-                            // "401 Unauthorized" generally indicates there is an issue with the authorization
-                            // grant. Puts OIDAuthState into an error state.
-                            let oauthError = OIDErrorUtilities.resourceServerAuthorizationError(withCode: 0,
-                                                                                                errorResponse: json,
-                                                                                                underlyingError: error)
-                            self.olAuthState.authState?.update(withAuthorizationError: oauthError)
-                            callback(false, OLOidcError.authorizationError("(\(oauthError)). Response: \(responseText ?? "RESPONSE_TEXT")"))
-                        } else {
-                            callback(false, OLOidcError.authorizationError("(\(response.statusCode)). Response: \(responseText ?? "RESPONSE_TEXT")"))
-                        }
-
-                        return
+            let issuer = URL(string: self.oidcConfig.issuer)!
+            OIDAuthorizationService.discoverConfiguration(forIssuer: issuer) { configuration, error in
+                guard configuration != nil else {
+                    print("Error retrieving discovery document: \(error?.localizedDescription ?? "Unknown error")")
+                        callback(error)
+                    return
+                  }
+
+                let redirect = "https://\(issuer.host ?? "onelogin.com")/logout"
+                let request = OIDEndSessionRequest(
+                    configuration: configuration!,
+                    idTokenHint: idToken,
+                    postLogoutRedirectURL: URL(string: redirect)!,
+                    additionalParameters: nil
+                )
+
+                let externalUserAgent = OIDExternalUserAgentIOS(presenting: presenter)
+                externalUserAgent?.setEphemeralBrowsingSession( self.ephemeralSession )
+                self.currentAuthorizationFlow = OIDAuthorizationService.present(request, externalUserAgent: externalUserAgent!) { response, error in
+                    if error != nil {
+                        callback(error)
                     }
-                    
-                    callback(true, nil)
                 }
             }
-            
-            task.resume()
         }
     }
     

From 26249dcdcfd3f257b0d434ec6fb0f47302b1e3fc Mon Sep 17 00:00:00 2001
From: Bryan Vestey <bryan.vestey@onelogin.com>
Date: Thu, 10 Mar 2022 16:13:53 -0800
Subject: [PATCH 5/6] Code cleanup

---
 ios-oidc/Oidc/OLOidc.swift          | 21 ---------------------
 ios-oidc/Oidc/OLOidcAuthState.swift |  3 ---
 ios-oidc/Oidc/OLOidcError.swift     |  6 ------
 3 files changed, 30 deletions(-)

diff --git a/ios-oidc/Oidc/OLOidc.swift b/ios-oidc/Oidc/OLOidc.swift
index 4a3081d..9d3a81f 100644
--- a/ios-oidc/Oidc/OLOidc.swift
+++ b/ios-oidc/Oidc/OLOidc.swift
@@ -7,33 +7,12 @@
 //
 
 import Foundation
-import WebKit
-import SafariServices
 
 @objc public enum TokenType: Int {
     case AccessToken = 0
     case RefreshToken = 1
 }
 
-private class RedirectDelegate: NSObject, URLSessionTaskDelegate {
-    func urlSession(
-        _: URLSession,
-        task: URLSessionTask,
-        willPerformHTTPRedirection: HTTPURLResponse,
-        newRequest: URLRequest,
-        completionHandler: (URLRequest?) -> Void
-    ) {
-        // Stops the redirection, and returns (internally) the response body.
-        completionHandler(nil)
-    }
-}
-
-private class CloseSafariOnOpen: NSObject, SFSafariViewControllerDelegate {
-    public func safariViewController(_ controller: SFSafariViewController, didCompleteInitialLoad didLoadSuccessfully: Bool) {
-        controller.dismiss(animated: false)
-    }
-}
-
 public class OLOidc: NSObject {
     
     @objc public let oidcConfig: OLOidcConfig
diff --git a/ios-oidc/Oidc/OLOidcAuthState.swift b/ios-oidc/Oidc/OLOidcAuthState.swift
index 543ba27..cff377f 100644
--- a/ios-oidc/Oidc/OLOidcAuthState.swift
+++ b/ios-oidc/Oidc/OLOidcAuthState.swift
@@ -32,9 +32,6 @@ open class OLOidcAuthState: NSObject {
     @objc open var refreshToken: String? {
         get {return authState?.lastTokenResponse?.refreshToken}
     }
-    @objc open var endSessionEndpoint: URL? {
-        get {return authState?.lastAuthorizationResponse.request.configuration.discoveryDocument?.endSessionEndpoint}
-    }
     @objc open var tokenEndpoint: URL? {
         get {return authState?.lastAuthorizationResponse.request.configuration.discoveryDocument?.tokenEndpoint}
     }
diff --git a/ios-oidc/Oidc/OLOidcError.swift b/ios-oidc/Oidc/OLOidcError.swift
index b25ccfb..99e2f47 100644
--- a/ios-oidc/Oidc/OLOidcError.swift
+++ b/ios-oidc/Oidc/OLOidcError.swift
@@ -12,13 +12,11 @@ public enum OLOidcError: Error, Equatable {
     case configFileParseFailure
     case configInvalid
     case missingConfiguration
-    case endSessionEndpointUndeclared
     case tokenEndpointUndeclared
     case userEndpointUndeclared
     case fetchingFreshTokenError(String)
     case gettingAccessTokenError
     case gettingIdTokenError
-    case generatingSignOutUrlError
     case httpRequestFailed(String)
     case nonHttpResponse
     case noResponseData
@@ -38,8 +36,6 @@ extension OLOidcError: LocalizedError {
             return "No configuration was provided to OLOidc."
         case .configInvalid:
             return "The config file contains invalid parameters."
-        case .endSessionEndpointUndeclared:
-            return "End session endpoint not declared in discovery document."
         case .tokenEndpointUndeclared:
             return "Token endpoint not declared in discovery document."
         case .userEndpointUndeclared:
@@ -50,8 +46,6 @@ extension OLOidcError: LocalizedError {
             return "Error getting accessToken"
         case .gettingIdTokenError:
             return "Error getting idToken"
-        case .generatingSignOutUrlError:
-            return "Error generating URL for signing out"
         case .httpRequestFailed(error: let error):
             return "HTTP request failed \(error)"
         case .nonHttpResponse:

From 00262266a0ca4d71c79ccfbd6f270687b8d84d5a Mon Sep 17 00:00:00 2001
From: Bryan Vestey <bryan.vestey@onelogin.com>
Date: Fri, 11 Mar 2022 15:29:50 -0800
Subject: [PATCH 6/6] Pass in application callback for logout, as prod works as
 expected

---
 ios-oidc/Oidc/OLOidc.swift | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/ios-oidc/Oidc/OLOidc.swift b/ios-oidc/Oidc/OLOidc.swift
index 9d3a81f..7f95684 100644
--- a/ios-oidc/Oidc/OLOidc.swift
+++ b/ios-oidc/Oidc/OLOidc.swift
@@ -93,20 +93,17 @@ public class OLOidc: NSObject {
                     return
                   }
 
-                let redirect = "https://\(issuer.host ?? "onelogin.com")/logout"
                 let request = OIDEndSessionRequest(
                     configuration: configuration!,
                     idTokenHint: idToken,
-                    postLogoutRedirectURL: URL(string: redirect)!,
+                    postLogoutRedirectURL: self.oidcConfig.redirectUri,
                     additionalParameters: nil
                 )
 
                 let externalUserAgent = OIDExternalUserAgentIOS(presenting: presenter)
                 externalUserAgent?.setEphemeralBrowsingSession( self.ephemeralSession )
                 self.currentAuthorizationFlow = OIDAuthorizationService.present(request, externalUserAgent: externalUserAgent!) { response, error in
-                    if error != nil {
-                        callback(error)
-                    }
+                    callback(error)
                 }
             }
         }