# NautheraBackchannelLogoutFailing

More than 10% of back-channel logout deliveries are failing.

## Meaning

Over 30 minutes, more than the threshold (10%) of deliveries counted in
`nauthera_backchannel_logout_deliveries_total` ended in something other than `success`,
for 30 minutes. `permanent` means the relying party refused the logout token or its
endpoint is not one that takes them (not retried); `exhausted` means retries ran out
(three attempts, five seconds each, within 30 seconds per logout); `dropped` means the
fanout was never started because the server was at its limit of concurrent fanouts or
shutting down.

## Impact

End users who signed out, or whose sessions an administrator ended, are still signed in
at the relying parties that missed the logout token, until those applications' own
sessions end. Security: a session meant to be revoked stays usable there.

## Diagnosis

1. Outcomes: `sum by (outcome) (rate(nauthera_backchannel_logout_deliveries_total\{
   job="<name>"\}[30m]))`.
2. Which clients and why: `kubectl -n <ns> logs deploy/<name> | jq 'select(.msg|startswith(
   "back-channel logout"))'`. Each line has `client_id`, `endpoint_host`, `status`,
   `attempts` and `cause`, such as `rp_rejected` (a 400: issuer, audience, algorithm or
   clock skew), `rp_misconfigured` (a status like 404 or 401), `rp_timeout`,
   `rp_unreachable`, `rp_tls_failed`, `host_not_global` (the host resolves to a private
   address the server will not dial), `egress_proxy_failed` or `notifier_saturated`.
3. The audit log records each delivery as `oidc.logout.token.delivered`.

## Mitigation

- One client failing (`rp_rejected`, `rp_misconfigured`, `rp_tls_failed`): give its
  owner the cause; they fix their endpoint or their logout token validation. Back-channel
  logout URIs are registered through dynamic registration, so the client's owner updates
  it there.
- `host_not_global`: the relying party is internal; the server refuses to dial non-global
  addresses, so it needs a publicly routable endpoint.
- `egress_proxy_failed`: fix the proxy named in `HTTPS_PROXY` / `HTTP_PROXY`.
- `notifier_saturated` or many `exhausted`: check whether many relying parties are slow
  at once and whether the server is overloaded.

## Escalation

Tell the owners of the failing relying parties, and the security team if sensitive
applications keep sessions after logout. If deliveries fail for endpoints that answer
correctly to a hand-made test, open an issue with the log lines (they carry only the
host, never the full URI) and the server version.

---

[Alert runbooks](https://www.nauthera.io/docs/v1/runbooks/alerts) · Generated from [`internal/runbook/alerts.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/alerts.yaml) and [`operator/internal/runbook/alerts.yaml`](https://github.com/nauthera/nauthera-server/blob/main/operator/internal/runbook/alerts.yaml) in nauthera-server.