Logout at Spring Authorization Server doesn't terminate user session in Keycloak

Getting advice
, ,
1

Hi everyone,

I am trying to implement an end-user initiated logout mechanism.

I have 4 main entities involved.

  • Client: an Angular app registered as a public OIDC client on Keycloak
  • Keycloak: behaves as an identity broker
  • Spring Authorization Server: identity provider registered on Keycloak
  • Resource Server: a Spring Boot application with a secure REST endpoint

When the end-user initiates a logout, a call is made by the Angular application to Keycloak’s end_session_endpoint. I have configured the logout URL for my identity provider (Spring Authorization Server) in Keycloak as http://localhost:9000/logout which is the default Spring Security logout endpoint.

Keycloak_config_for_external_idp
Keycloak_config_for_external_idp1696×827 63 KB

In the Network tab of Developer Console, the sequence of calls happen as below:

While inspecting the DEBUG logs in the Spring Authorization Server, I am able to see the logout happen for that particular end-user including invalidating the JSESSIONID, however the session doesn’t terminate in Keycloak which causes the user to stay logged in and access the secure REST endpoint.

Is the Spring Authorization Server expected to return a specific response back to Keycloak to convey that the logout process is complete at it’s end and that Keycloak can end the session now?

This is my logic for logout at Spring Authorization Server.

@Bean
@Order(Ordered.LOWEST_PRECEDENCE)
public SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception {

	http.csrf(csrf -> csrf.disable())
				.authorizeHttpRequests(
						authorize -> authorize.mvcMatchers("/redis/**").permitAll().anyRequest().authenticated())
				.formLogin(form -> form.loginPage("/login").permitAll())
				.addFilterAfter(cookieFilter, ChannelProcessingFilter.class)
				.logout().logoutSuccessUrl("http://localhost:4200");
		
	return http.build();
}

I am totally clueless about what I am missing to make Keycloak end the session at it’s end.
Any leads will be greatly appreciated.
Thank you!

2

Solution to my problem: Logout at Spring Authorization Server doesn’t terminate user session in Keycloak - Stack Overflow