I'm not finding the "Valid post logout URIs" field

Configuring the server
1

I’m using Keycloak 18.0.0 and I found an update on logout (https://www.keycloak.org/2022/04/keycloak-1800-released#_openid_connect_logout) where it is necessary to register a post logout redirect URI in the Valid post logout URIs field within the Keycloak interface. But this field is not appearing for me in the client settings.

What could be causing this?

image
image1944×954 58.5 KB

2

AFAIK it’s only available in the “new” admin console UI. For that, you have to go into Realm settings → Themes and switch the Admin theme to keycloak.v2.

3

It doesn’t seem to be available for version 18.0.0.

I did a local install and realized that in version 19.0.3 this theme is already by default. However, in the project I’m working on, we use version 18.0.0 and we’re having problems using logout with Redirect URIs, precisely because of the logout update of the release.

image
image1541×652 39.8 KB

4

Good point. I don’t know of another way to do it other than to upgrade to 19.

5

Keycloak 18 takes the configured valid login redirect URIs as valid post logout redirects. If that is ok for you, there’s no need to upgrade to the (buggy) 19 version with that (more buggy) new admin console…

2 Likes
6

@mbonn in this case should i continue using post_logout_redirect_uri or should i use redirect_uri as url pattern for $keycloak.logout() ?

7

i’ve tried using redirect URIs this way:

this.$keycloak.logout({ redirectUri: "myRedirectUriHere", id_token_hint: myIdTokenHere });

In this attempt I got an attempt to redirect to the correct route, but with a return message “Invalid redirect uri”.
If i pass:

this.$keycloak.logout({ post_logout_redirect_uri: "myRedirectUriHere", id_token_hint: myIdTokenHere });

the logout is sucessfully, but route redirection doesn’t work.

8

I confirmed that 18 don’t have a “valid post logout url” for the clients in the admin console. Not sure why. The redirect URI field should work.

Looking at the code, I think the javascript adapter should be used as

keycloak.logout({
    redirectUri: "myRedirectUriHere"
});

The ID Token should be handled automatically.

The adapter code has this snipped, which I belive shows that the redirectUri is used to build the post_logout_redirect_uri and the it_token_hint is filled automatically:

    kc.createLogoutUrl = function(options) {
        var url = kc.endpoints.logout()
            + '?client_id=' + encodeURIComponent(kc.clientId)
            + '&post_logout_redirect_uri=' + encodeURIComponent(adapter.redirectUri(options, false));

        if (kc.idToken) {
            url += '&id_token_hint=' + encodeURIComponent(kc.idToken);
        }

        return url;
    }