Front-channel logout example using OIDC?

xgp · February 24, 2025, 9:02pm

Front channel logout question:

on Realm A, I have an OIDC Client which is another Keycloak instance. It has front-channel logout turned on, with the OIDC logout url from Realm B.
on Realm B, I have a Keycloak-OIDC identity provider which points Realm A.
on Realm B, I set the identity provider pointing to Realm A as the default in the Identity Provider Redirector authenticator
I log into the account console in both Realm A and Realm B.
When I log out from Realm B, I’m logged out from both Realm B and A.
When I log out from Realm A
- I see a flash of a page “You are logging out …” as it redirects to https://somehost.com/auth/realms/realmb/protocol/openid-connect/logout?sid=9f5db4c3-4f8f-477c-afaa-12350f8f6ee3&iss=http%3A%2F%2Flocalhost%3A8080%2Fauth%2Frealms%2Frealma which returns a 200. There must also be something happening on that page in js, as it then goes back to the Realm A account console without a 300.
- I’m still logged in to Realm B.

How do I set it up so that when I log out in either realm, I’m logged out from both? I feel like I’ve done this before successfully, but I can’t do it now. Any ideas?

xgp · February 26, 2025, 10:26am

Doing some more research here. In the front-channel OIDC spec, it says:

RPs supporting HTTP-based logout register a logout URI with the OP as part of their client registration. The domain, port, and scheme of this URL MUST be the same as that of a registered Redirection URI value.

I’ve added the Realm B OIDC logout url to the Realm A client redirect URIs, but no effect.

xgp · February 26, 2025, 10:29am

Is it a flawed assumption that I can use the Realm B OIDC logout url as the Realm A client front channel logout url? Is this instead supposed to be an application url that calls the end session endpoint?

xgp · February 26, 2025, 10:46am

I think the answer is yes, it’s not meant for this use.

This endpoint is aligned with OpenID Connect RP-Initiated Logout specification Final: OpenID Connect RP-Initiated Logout 1.0

github.com/keycloak/keycloak

services/src/main/java/org/keycloak/protocol/oidc/endpoints/LogoutEndpoint.java

main


      
          public Response issueUserInfoPreflight() {
              return Cors.builder().auth().preflight().add(Response.ok());
          }
          
          /**
           * Logout user session.  User must be logged in via a session cookie.
           *
           * When the logout is initiated by a remote idp, the parameter "initiating_idp" can be supplied. This param will
           * prevent upstream logout (since the logout procedure has already been started in the remote idp).
           *
           * This endpoint is aligned with OpenID Connect RP-Initiated Logout specification https://openid.net/specs/openid-connect-rpinitiated-1_0.html#RPLogout
           *
           * All parameters are optional. Some combinations of parameters are invalid as described in the specification
           *
           * @param encodedIdToken Parameter "id_token_hint" as described in the specification.
           * @param clientId Parameter "client_id" as described in the specification.
           * @param postLogoutRedirectUri Parameter "post_logout_redirect_uri" as described in the specification with the URL to redirect after logout.
           * @param state Parameter "state" as described in the specification. Will be used to send "state" when redirecting back to the application after the logout
           * @param uiLocales Parameter "ui_locales" as described in the specification. Can be used by the client to display pages in specified locale (if any pages are going to be displayed to the user during logout)
           * @param initiatingIdp The alias of the idp initiating the logout.
           * @return

and there are no params for sid and iss

github.com/keycloak/keycloak

services/src/main/java/org/keycloak/protocol/oidc/endpoints/LogoutEndpoint.java

main


      
          @GET
          @NoCache
          public Response logout(@QueryParam(OIDCLoginProtocol.ID_TOKEN_HINT) String encodedIdToken,
                                 @QueryParam(OIDCLoginProtocol.CLIENT_ID_PARAM) String clientId,
                                 @QueryParam(OIDCLoginProtocol.POST_LOGOUT_REDIRECT_URI_PARAM) String postLogoutRedirectUri,
                                 @QueryParam(OIDCLoginProtocol.STATE_PARAM) String state,
                                 @QueryParam(OIDCLoginProtocol.UI_LOCALES_PARAM) String uiLocales,
                                 @QueryParam(AuthenticationManager.INITIATING_IDP_PARAM) String initiatingIdp) {

embesozzi · February 26, 2025, 4:44pm

Just a minor consideration about front-channel logout. The upcoming deprecation of third-party cookies will impact identity federation in several ways:

OpenID Connect Front-Channel Logout
OpenID Connect Session Management
iframe-based background token renewal
iframe-based login widget

I don’t know if anything has changed recently, but when the deprecation was announced, those were the future issues to bear in mind

Topic		Replies	Views
OIDC Identity Provider Logout - How does it work? Getting advice identity-brokering , oidc	1	3965	June 10, 2023
Front-Channel Logout with IDP Logout URL Getting advice oidc	0	1786	May 13, 2022
Keycloak realm as client and client back channel logout Configuring the server	1	478	October 28, 2021
SSO server apps , multi tab logout Getting advice oidc	1	1405	February 16, 2022
Logout from OpenId Client when logout from another SAML client Getting advice oidc , saml	5	1586	December 23, 2020

Front-channel logout example using OIDC?

Related topics