Admin URL not called - how to do/trigger backchannel logout correctly?

Turns out you have to include a keycloak-specific client_session_state=${sessionId} parameter when the protocol/openid-connect/token endpoint is called.

Thanks for your post, @jtheof!