From f5373281ad7885025b5a2e1d811d01bf83336ff3 Mon Sep 17 00:00:00 2001
From: Raphael Lullis <raphael@mushroomlabs.com>
Date: Tue, 29 Apr 2025 04:09:59 +0200
Subject: [PATCH] Backchannel Logout

 - Add migration to add backchannel logout support
 - Add parameters related to backchannel logout on OIDC Discovery View
 - Change application creation and update form
 - Change template that renders information about the application
---
 AUTHORS                                       |  1 +
 CHANGELOG.md                                  |  2 +
 docs/oidc.rst                                 | 23 ++++++
 docs/settings.rst                             | 10 +++
 oauth2_provider/apps.py                       |  2 +-
 oauth2_provider/checks.py                     | 13 ++++
 oauth2_provider/exceptions.py                 |  4 +
 oauth2_provider/handlers.py                   | 18 +++++
 ...0013_application_backchannel_logout_uri.py | 18 +++++
 oauth2_provider/models.py                     | 68 ++++++++++++++++-
 oauth2_provider/settings.py                   |  4 +
 .../oauth2_provider/application_detail.html   |  5 ++
 oauth2_provider/views/application.py          | 70 +++++++----------
 oauth2_provider/views/oidc.py                 |  7 ++
 tests/presets.py                              |  6 ++
 tests/test_backchannel_logout.py              | 76 +++++++++++++++++++
 tests/test_django_checks.py                   | 22 ++++++
 tests/test_oidc_views.py                      | 12 +++
 18 files changed, 317 insertions(+), 44 deletions(-)
 create mode 100644 oauth2_provider/handlers.py
 create mode 100644 oauth2_provider/migrations/0013_application_backchannel_logout_uri.py
 create mode 100644 tests/test_backchannel_logout.py

diff --git a/AUTHORS b/AUTHORS
index 2d3f80527..90271a635 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -100,6 +100,7 @@ Peter Karman
 Peter McDonald
 Petr Dlouhý
 pySilver
+Raphael Lullis
 Rodney Richardson
 Rustem Saiargaliev
 Rustem Saiargaliev
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 32dd1734c..faa0d3586 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,9 +6,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 
 ## [unreleased]
+
 ### Added
 * #1506 Support for Wildcard Origin and Redirect URIs
 * #1586 Turkish language support added
+* #1545 Support for OIDC Back-Channel Logout
 
 <!--
 ### Changed
diff --git a/docs/oidc.rst b/docs/oidc.rst
index 1669a00d4..f4a5f6c7c 100644
--- a/docs/oidc.rst
+++ b/docs/oidc.rst
@@ -169,6 +169,29 @@ This feature has to be enabled separately as it is an extension to the core stan
    }
 
 
+Backchannel Logout Support
+~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+`Backchannel Logout`_ is an extension to the core standard which
+allows the OP to send direct requests to terminate sessions at the RP.
+
+.. code-block:: python
+
+   OAUTH2_PROVIDER = {
+       # OIDC has to be enabled to use Backchannel logout
+       "OIDC_ENABLED": True,
+       "OIDC_ISS_ENDPOINT": "https://idp.example.com", # Required for issuing logout tokens
+       # Enable and configure Backchannel Logout Support
+       "OIDC_BACKCHANNEL_LOGOUT_ENABLED": True,
+       # ... any other settings you want
+   }
+
+.. _Backchannel Logout: https://openid.net/specs/openid-connect-backchannel-1_0.html
+
+To make use of this, the application being created needs to provide a
+valid `backchannel_logout_endpoint`.
+
+
 Setting up OIDC enabled clients
 ===============================
 
diff --git a/docs/settings.rst b/docs/settings.rst
index 985ca5d2c..35a0e9742 100644
--- a/docs/settings.rst
+++ b/docs/settings.rst
@@ -361,6 +361,7 @@ When is set to ``False`` (default) the `OpenID Connect RP-Initiated Logout <http
 endpoint is not enabled. OpenID Connect RP-Initiated Logout enables an :term:`Client` (Relying Party)
 to request that a :term:`Resource Owner` (End User) is logged out at the :term:`Authorization Server` (OpenID Provider).
 
+
 OIDC_RP_INITIATED_LOGOUT_ALWAYS_PROMPT
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 Default: ``True``
@@ -400,6 +401,15 @@ discovery metadata from ``OIDC_ISS_ENDPOINT`` +
 If unset, the default location is used, eg if ``django-oauth-toolkit`` is
 mounted at ``/o``, it will be ``<server-address>/o``.
 
+OIDC_BACKCHANNEL_LOGOUT_ENABLED
+~~~~~~~~~~~~~~~~~~~~~~~~
+Default: ``False``
+
+When is set to ``False`` (default) the `OpenID Connect Backchannel Logout <https://openid.net/specs/openid-connect-backchannel-1_0.html>`_
+extension is not enabled. OpenID Connect Backchannel Logout enables the :term:`Authorization Server` (OpenID Provider) to submit a JWT token to an endpoint controlled by the :term:`Client` (Relying Party)
+indicating that a session from the :term:`Resource Owner` (End User) has ended.
+
+
 OIDC_RESPONSE_TYPES_SUPPORTED
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 Default::
diff --git a/oauth2_provider/apps.py b/oauth2_provider/apps.py
index 3ad08b715..1a9b15993 100644
--- a/oauth2_provider/apps.py
+++ b/oauth2_provider/apps.py
@@ -7,4 +7,4 @@ class DOTConfig(AppConfig):
 
     def ready(self):
         # Import checks to ensure they run.
-        from . import checks  # noqa: F401
+        from . import checks, handlers  # noqa: F401
diff --git a/oauth2_provider/checks.py b/oauth2_provider/checks.py
index 848ba1af7..375049e20 100644
--- a/oauth2_provider/checks.py
+++ b/oauth2_provider/checks.py
@@ -26,3 +26,16 @@ def validate_token_configuration(app_configs, **kwargs):
         return [checks.Error("The token models are expected to be stored in the same database.")]
 
     return []
+
+
+@checks.register()
+def validate_backchannel_logout(app_configs, **kwargs):
+    errors = []
+
+    if oauth2_settings.OIDC_BACKCHANNEL_LOGOUT_ENABLED:
+        if not callable(oauth2_settings.OIDC_BACKCHANNEL_LOGOUT_HANDLER):
+            errors.append(checks.Error("OIDC_BACKCHANNEL_LOGOUT_HANDLER must be a callable."))
+        if not oauth2_settings.OIDC_ISS_ENDPOINT:
+            errors.append(checks.Error("OIDC_ISS_ENDPOINT must be set to enable OIDC backchannel logout."))
+
+    return errors
diff --git a/oauth2_provider/exceptions.py b/oauth2_provider/exceptions.py
index f68a651b6..e45de91b5 100644
--- a/oauth2_provider/exceptions.py
+++ b/oauth2_provider/exceptions.py
@@ -35,6 +35,10 @@ def __init__(self, description=None):
         super().__init__(message)
 
 
+class BackchannelLogoutRequestError(OIDCError):
+    error = "backchannel_logout_request_failed"
+
+
 class InvalidRequestFatalError(OIDCError):
     """
     For fatal errors. These are requests with invalid parameter values, missing parameters or otherwise
diff --git a/oauth2_provider/handlers.py b/oauth2_provider/handlers.py
new file mode 100644
index 000000000..25e866237
--- /dev/null
+++ b/oauth2_provider/handlers.py
@@ -0,0 +1,18 @@
+import logging
+
+from django.contrib.auth.signals import user_logged_out
+from django.dispatch import receiver
+
+from .settings import oauth2_settings
+
+
+logger = logging.getLogger(__name__)
+
+
+@receiver(user_logged_out)
+def on_user_logged_out_maybe_send_backchannel_logout(sender, **kwargs):
+    handler = oauth2_settings.OIDC_BACKCHANNEL_LOGOUT_HANDLER
+    if not oauth2_settings.OIDC_BACKCHANNEL_LOGOUT_ENABLED or not callable(handler):
+        return
+
+    handler(user=kwargs["user"])
diff --git a/oauth2_provider/migrations/0013_application_backchannel_logout_uri.py b/oauth2_provider/migrations/0013_application_backchannel_logout_uri.py
new file mode 100644
index 000000000..393afd58f
--- /dev/null
+++ b/oauth2_provider/migrations/0013_application_backchannel_logout_uri.py
@@ -0,0 +1,18 @@
+# Generated by Django 5.2 on 2025-06-06 12:42
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('oauth2_provider', '0012_add_token_checksum'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='application',
+            name='backchannel_logout_uri',
+            field=models.URLField(blank=True, help_text='Backchannel Logout URI where logout tokens will be sent', null=True),
+        ),
+    ]
diff --git a/oauth2_provider/models.py b/oauth2_provider/models.py
index a76db37c0..f89b97e85 100644
--- a/oauth2_provider/models.py
+++ b/oauth2_provider/models.py
@@ -1,4 +1,5 @@
 import hashlib
+import json
 import logging
 import time
 import uuid
@@ -6,6 +7,7 @@
 from datetime import timedelta
 from urllib.parse import parse_qsl, urlparse
 
+import requests
 from django.apps import apps
 from django.conf import settings
 from django.contrib.auth.hashers import identify_hasher, make_password
@@ -14,10 +16,11 @@
 from django.urls import reverse
 from django.utils import timezone
 from django.utils.translation import gettext_lazy as _
-from jwcrypto import jwk
+from jwcrypto import jwk, jwt
 from jwcrypto.common import base64url_encode
 from oauthlib.oauth2.rfc6749 import errors
 
+from .exceptions import BackchannelLogoutRequestError
 from .generators import generate_client_id, generate_client_secret
 from .scopes import get_scopes_backend
 from .settings import oauth2_settings
@@ -76,6 +79,7 @@ class AbstractApplication(models.Model):
     * :attr:`client_secret` Confidential secret issued to the client during
                             the registration process as described in :rfc:`2.2`
     * :attr:`name` Friendly name for the Application
+    * :attr:`backchannel_logout_uri` Backchannel Logout URI (OIDC-only)
     """
 
     CLIENT_CONFIDENTIAL = "confidential"
@@ -147,6 +151,9 @@ class AbstractApplication(models.Model):
         help_text=_("Allowed origins list to enable CORS, space separated"),
         default="",
     )
+    backchannel_logout_uri = models.URLField(
+        blank=True, null=True, help_text="Backchannel Logout URI where logout tokens will be sent"
+    )
 
     class Meta:
         abstract = True
@@ -629,6 +636,53 @@ def revoke(self):
         """
         self.delete()
 
+    def send_backchannel_logout_request(self, ttl=timedelta(minutes=10)):
+        """
+        Send a logout token to the applications backchannel logout uri
+        """
+        try:
+            assert oauth2_settings.OIDC_BACKCHANNEL_LOGOUT_ENABLED, "Backchannel logout not enabled"
+            assert self.application.algorithm != AbstractApplication.NO_ALGORITHM, (
+                "Application must provide signing algorithm"
+            )
+            assert self.application.backchannel_logout_uri is not None, (
+                "URL for backchannel logout not provided by client"
+            )
+
+            issued_at = timezone.now()
+            expiration_date = issued_at + ttl
+
+            claims = {
+                "iss": oauth2_settings.OIDC_ISS_ENDPOINT,
+                "sub": str(self.user.id),
+                "aud": str(self.application.client_id),
+                "iat": int(issued_at.timestamp()),
+                "exp": int(expiration_date.timestamp()),
+                "jti": self.jti,
+                "events": {"http://schemas.openid.net/event/backchannel-logout": {}},
+            }
+
+            # Standard JWT header
+            header = {"typ": "logout+jwt", "alg": self.application.algorithm}
+
+            # RS256 consumers expect a kid in the header for verifying the token
+            if self.application.algorithm == AbstractApplication.RS256_ALGORITHM:
+                header["kid"] = self.application.jwk_key.thumbprint()
+
+            token = jwt.JWT(
+                header=json.dumps(header, default=str),
+                claims=json.dumps(claims, default=str),
+            )
+
+            token.make_signed_token(self.application.jwk_key)
+
+            headers = {"Content-Type": "application/x-www-form-urlencoded"}
+            data = {"logout_token": token.serialize()}
+            response = requests.post(self.application.backchannel_logout_uri, headers=headers, data=data)
+            response.raise_for_status()
+        except (AssertionError, requests.RequestException) as exc:
+            raise BackchannelLogoutRequestError(str(exc))
+
     @property
     def scopes(self):
         """
@@ -859,3 +913,15 @@ def is_origin_allowed(origin, allowed_origins):
             return True
 
     return False
+
+
+def send_backchannel_logout_requests(user):
+    """
+    Creates logout tokens for all id tokens associated with the user
+    """
+    id_tokens = IDToken.objects.filter(application__backchannel_logout_uri__isnull=False, user=user)
+    for id_token in id_tokens:
+        try:
+            id_token.send_backchannel_logout_request()
+        except BackchannelLogoutRequestError as exc:
+            logger.warn(str(exc))
diff --git a/oauth2_provider/settings.py b/oauth2_provider/settings.py
index 9771aa4e7..c64b56fac 100644
--- a/oauth2_provider/settings.py
+++ b/oauth2_provider/settings.py
@@ -92,6 +92,8 @@
         "client_secret_post",
         "client_secret_basic",
     ],
+    "OIDC_BACKCHANNEL_LOGOUT_ENABLED": False,
+    "OIDC_BACKCHANNEL_LOGOUT_HANDLER": "oauth2_provider.models.send_backchannel_logout_requests",
     "OIDC_RP_INITIATED_LOGOUT_ENABLED": False,
     "OIDC_RP_INITIATED_LOGOUT_ALWAYS_PROMPT": True,
     "OIDC_RP_INITIATED_LOGOUT_STRICT_REDIRECT_URIS": False,
@@ -144,7 +146,9 @@
     "ACCESS_TOKEN_ADMIN_CLASS",
     "GRANT_ADMIN_CLASS",
     "ID_TOKEN_ADMIN_CLASS",
+    "LOGOUT_TOKEN_ADMIN_CLASS",
     "REFRESH_TOKEN_ADMIN_CLASS",
+    "OIDC_BACKCHANNEL_LOGOUT_HANDLER",
 )
 
 
diff --git a/oauth2_provider/templates/oauth2_provider/application_detail.html b/oauth2_provider/templates/oauth2_provider/application_detail.html
index 74b71ee74..0ba57cdfa 100644
--- a/oauth2_provider/templates/oauth2_provider/application_detail.html
+++ b/oauth2_provider/templates/oauth2_provider/application_detail.html
@@ -45,6 +45,11 @@ <h3 class="block-center-heading">{{ application.name }}</h3>
                 <p><b>{% trans "Allowed Origins" %}</b></p>
                 <textarea class="input-block-level" readonly>{{ application.allowed_origins }}</textarea>
             </li>
+
+            <li>
+              <p><b>{% trans "Backchannel Logout URI" %}</b></p>
+              <input class="input-block-level" type="text" value="{{ application.backchannel_logout_uri }}" readonly>
+            </li>
         </ul>
 
         <div class="btn-toolbar">
diff --git a/oauth2_provider/views/application.py b/oauth2_provider/views/application.py
index b896c45e3..6bea678ce 100644
--- a/oauth2_provider/views/application.py
+++ b/oauth2_provider/views/application.py
@@ -3,6 +3,8 @@
 from django.urls import reverse_lazy
 from django.views.generic import CreateView, DeleteView, DetailView, ListView, UpdateView
 
+from oauth2_provider.settings import oauth2_settings
+
 from ..models import get_application_model
 
 
@@ -17,33 +19,37 @@ def get_queryset(self):
         return get_application_model().objects.filter(user=self.request.user)
 
 
-class ApplicationRegistration(LoginRequiredMixin, CreateView):
+class ApplicationEditorMixin(LoginRequiredMixin):
+    def get_form_class(self):
+        """
+        Returns the form class for the application model
+        """
+        base_fields = [
+            "name",
+            "client_id",
+            "client_secret",
+            "hash_client_secret",
+            "client_type",
+            "authorization_grant_type",
+            "redirect_uris",
+            "post_logout_redirect_uris",
+            "allowed_origins",
+            "algorithm",
+        ]
+
+        if oauth2_settings.OIDC_BACKCHANNEL_LOGOUT_ENABLED:
+            base_fields.append("backchannel_logout_uri")
+
+        return modelform_factory(get_application_model(), fields=base_fields)
+
+
+class ApplicationRegistration(ApplicationEditorMixin, CreateView):
     """
     View used to register a new Application for the request.user
     """
 
     template_name = "oauth2_provider/application_registration_form.html"
 
-    def get_form_class(self):
-        """
-        Returns the form class for the application model
-        """
-        return modelform_factory(
-            get_application_model(),
-            fields=(
-                "name",
-                "client_id",
-                "client_secret",
-                "hash_client_secret",
-                "client_type",
-                "authorization_grant_type",
-                "redirect_uris",
-                "post_logout_redirect_uris",
-                "allowed_origins",
-                "algorithm",
-            ),
-        )
-
     def form_valid(self, form):
         form.instance.user = self.request.user
         return super().form_valid(form)
@@ -77,30 +83,10 @@ class ApplicationDelete(ApplicationOwnerIsUserMixin, DeleteView):
     template_name = "oauth2_provider/application_confirm_delete.html"
 
 
-class ApplicationUpdate(ApplicationOwnerIsUserMixin, UpdateView):
+class ApplicationUpdate(ApplicationOwnerIsUserMixin, ApplicationEditorMixin, UpdateView):
     """
     View used to update an application owned by the request.user
     """
 
     context_object_name = "application"
     template_name = "oauth2_provider/application_form.html"
-
-    def get_form_class(self):
-        """
-        Returns the form class for the application model
-        """
-        return modelform_factory(
-            get_application_model(),
-            fields=(
-                "name",
-                "client_id",
-                "client_secret",
-                "hash_client_secret",
-                "client_type",
-                "authorization_grant_type",
-                "redirect_uris",
-                "post_logout_redirect_uris",
-                "allowed_origins",
-                "algorithm",
-            ),
-        )
diff --git a/oauth2_provider/views/oidc.py b/oauth2_provider/views/oidc.py
index a252f1be4..120e1ba4b 100644
--- a/oauth2_provider/views/oidc.py
+++ b/oauth2_provider/views/oidc.py
@@ -101,8 +101,15 @@ def get(self, request, *args, **kwargs):
             "code_challenge_methods_supported": [key for key, _ in AbstractGrant.CODE_CHALLENGE_METHODS],
             "claims_supported": oidc_claims,
         }
+
+        if oauth2_settings.OIDC_BACKCHANNEL_LOGOUT_ENABLED:
+            data["backchannel_logout_supported"] = True
+            # We need to issue SID claims on tokens to support this.
+            data["backchannel_logout_session_supported"] = False
+
         if oauth2_settings.OIDC_RP_INITIATED_LOGOUT_ENABLED:
             data["end_session_endpoint"] = end_session_endpoint
+
         response = JsonResponse(data)
         response["Access-Control-Allow-Origin"] = "*"
         return response
diff --git a/tests/presets.py b/tests/presets.py
index 4538c64eb..13b9fac66 100644
--- a/tests/presets.py
+++ b/tests/presets.py
@@ -37,6 +37,12 @@
 OIDC_SETTINGS_RP_LOGOUT_DENY_EXPIRED["OIDC_RP_INITIATED_LOGOUT_ACCEPT_EXPIRED_TOKENS"] = False
 OIDC_SETTINGS_RP_LOGOUT_KEEP_TOKENS = deepcopy(OIDC_SETTINGS_RP_LOGOUT)
 OIDC_SETTINGS_RP_LOGOUT_KEEP_TOKENS["OIDC_RP_INITIATED_LOGOUT_DELETE_TOKENS"] = False
+OIDC_SETTINGS_BACKCHANNEL_LOGOUT = deepcopy(OIDC_SETTINGS_RW)
+OIDC_SETTINGS_BACKCHANNEL_LOGOUT["OIDC_BACKCHANNEL_LOGOUT_ENABLED"] = True
+
+OIDC_SETTINGS_BACKCHANNEL_LOGOUT_BAD_HANDLER = deepcopy(OIDC_SETTINGS_BACKCHANNEL_LOGOUT)
+OIDC_SETTINGS_BACKCHANNEL_LOGOUT_BAD_HANDLER["OIDC_BACKCHANNEL_LOGOUT_HANDLER"] = "not.a.real.function"
+
 REST_FRAMEWORK_SCOPES = {
     "SCOPES": {
         "read": "Read scope",
diff --git a/tests/test_backchannel_logout.py b/tests/test_backchannel_logout.py
new file mode 100644
index 000000000..a9fe09faa
--- /dev/null
+++ b/tests/test_backchannel_logout.py
@@ -0,0 +1,76 @@
+import datetime
+from unittest.mock import patch
+
+import pytest
+from django.utils import timezone
+from django.contrib.auth import get_user_model
+from django.test import RequestFactory
+from django.urls import reverse
+
+from oauth2_provider.exceptions import BackchannelLogoutRequestError
+from oauth2_provider.models import get_application_model, get_id_token_model, send_backchannel_logout_requests
+from oauth2_provider.views import ApplicationRegistration
+
+from . import presets
+from .common_testing import OAuth2ProviderTestCase as TestCase
+
+
+Application = get_application_model()
+IDToken = get_id_token_model()
+User = get_user_model()
+
+
+@pytest.mark.usefixtures("oauth2_settings")
+@pytest.mark.oauth2_settings(presets.OIDC_SETTINGS_BACKCHANNEL_LOGOUT)
+class TestBackchannelLogout(TestCase):
+    def setUp(self):
+        self.developer = User.objects.create_user(username="app_developer", password="123456")
+        self.user = User.objects.create_user(username="app_user", password="654321")
+        self.application = Application.objects.create(
+            name="test_client_credentials_app",
+            user=self.developer,
+            client_type=Application.CLIENT_PUBLIC,
+            authorization_grant_type=Application.GRANT_CLIENT_CREDENTIALS,
+            algorithm=Application.RS256_ALGORITHM,
+            client_secret="1234567890asdfghjkqwertyuiopzxcvbnm",
+            backchannel_logout_uri="http://rp.example.com/logout",
+        )
+        now = timezone.now()
+        expiration_date = now + datetime.timedelta(minutes=180)
+        self.id_token = IDToken.objects.create(
+            application=self.application, user=self.user, expires=expiration_date
+        )
+
+    def test_on_logout_handler_is_called_for_user(self):
+        with patch("oauth2_provider.models.send_backchannel_logout_requests") as backchannel_handler:
+            self.client.login(username="app_user", password="654321")
+            self.client.logout()
+            backchannel_handler.assert_called_once()
+            args, kwargs = backchannel_handler.call_args
+            self.assertEqual(kwargs.get("user"), self.user)
+
+    def test_logout_token_is_signed_for_user(self):
+        with patch("requests.post") as mocked_post:
+            self.client.login(username="app_user", password="654321")
+            self.client.logout()
+            mocked_post.assert_called_once()
+
+    def test_raises_exception_on_bad_application(self):
+        self.application.algorithm = Application.NO_ALGORITHM
+        self.application.save()
+        with self.assertRaises(BackchannelLogoutRequestError):
+            self.id_token.send_backchannel_logout_request()
+
+    def test_new_application_form_has_backchannel_logout_field(self):
+        factory = RequestFactory()
+        url = reverse("oauth2_provider:register")
+        request = factory.get(url)
+        request.user = self.user
+        view = ApplicationRegistration(request=request)
+        form = view.get_form()
+        self.assertTrue("backchannel_logout_uri" in form.fields.keys())
+
+    def test_logout_sender_does_not_crash_on_backchannel_error(self):
+        with patch.object(self.id_token, "send_backchannel_logout_request") as mock_func:
+            mock_func.side_effect = BackchannelLogoutRequestError("Bad Gateway")
+            send_backchannel_logout_requests(self.user)
diff --git a/tests/test_django_checks.py b/tests/test_django_checks.py
index 77025b115..9c954089c 100644
--- a/tests/test_django_checks.py
+++ b/tests/test_django_checks.py
@@ -1,8 +1,18 @@
+from copy import deepcopy
+
 from django.core.management import call_command
 from django.core.management.base import SystemCheckError
 from django.test import override_settings
 
 from .common_testing import OAuth2ProviderTestCase as TestCase
+from .presets import OIDC_SETTINGS_BACKCHANNEL_LOGOUT
+
+
+BAD_HANDLER_SETTINGS = deepcopy(OIDC_SETTINGS_BACKCHANNEL_LOGOUT)
+BAD_HANDLER_SETTINGS["OIDC_BACKCHANNEL_LOGOUT_HANDLER"] = "sys.api_version"
+
+MISSING_ISS_OIDC_ENDPOINT = deepcopy(OIDC_SETTINGS_BACKCHANNEL_LOGOUT)
+MISSING_ISS_OIDC_ENDPOINT["OIDC_ISS_ENDPOINT"] = None
 
 
 class DjangoChecksTestCase(TestCase):
@@ -18,3 +28,15 @@ def test_checks_fail_when_router_crosses_databases(self):
         message = "The token models are expected to be stored in the same database."
         with self.assertRaisesMessage(SystemCheckError, message):
             call_command("check")
+
+    @override_settings(OAUTH2_PROVIDER=BAD_HANDLER_SETTINGS)
+    def test_checks_fail_when_backchannel_logout_handler_is_not_callable(self):
+        message = "OIDC_BACKCHANNEL_LOGOUT_HANDLER must be a callable."
+        with self.assertRaisesMessage(SystemCheckError, message):
+            call_command("check")
+
+    @override_settings(OAUTH2_PROVIDER=MISSING_ISS_OIDC_ENDPOINT)
+    def test_checks_fail_when_iss_oidc_endpoint_is_missing(self):
+        message = "OIDC_ISS_ENDPOINT must be set to enable OIDC backchannel logout."
+        with self.assertRaisesMessage(SystemCheckError, message):
+            call_command("check")
diff --git a/tests/test_oidc_views.py b/tests/test_oidc_views.py
index 65197cbd1..5996d5647 100644
--- a/tests/test_oidc_views.py
+++ b/tests/test_oidc_views.py
@@ -152,6 +152,18 @@ def test_get_connect_discovery_info_without_rsa_key(self):
         self.assertEqual(response.status_code, 200)
         assert response.json()["id_token_signing_alg_values_supported"] == ["HS256"]
 
+    def test_get_backchannel_logout_support_info_when_enabled(self):
+        self.oauth2_settings.OIDC_BACKCHANNEL_LOGOUT_ENABLED = True
+        response = self.client.get(reverse("oauth2_provider:oidc-connect-discovery-info"))
+        response_data = response.json()
+        self.assertTrue("backchannel_logout_supported" in response_data)
+
+    def test_no_backchannel_logout_support_when_disabled(self):
+        self.oauth2_settings.OIDC_BACKCHANNEL_LOGOUT_ENABLED = False
+        response = self.client.get(reverse("oauth2_provider:oidc-connect-discovery-info"))
+        response_data = response.json()
+        self.assertFalse("backchannel_logout_supported" in response_data)
+
 
 @pytest.mark.usefixtures("oauth2_settings")
 @pytest.mark.oauth2_settings(presets.OIDC_SETTINGS_RW)