Keycloak: Identity Broker Logout not working as expected #15755

nehacharya04 · 2022-11-29T23:36:00Z

nehacharya04
Nov 29, 2022

My scenario has four entities:

Client: an Angular app, registered on Keycloak as a public client
Keycloak: configured as an Identity Broker
Spring Authorization Server: configured as an external/custom Identity Provider (IDP) on Keycloak
Resource Server: a Spring Boot application with a secure REST endpoint which accepts JWT tokens (issued by Keycloak (as per it's brokering mechanism) and sent by the client application on behalf of an end-user)

I am trying to implement the logout mechanism and facing 2 main issues:

The Angular application gives a call to the Keycloak logout endpoint using this.keycloak.logout() which redirects the user to Keycloak's login page (http://localhost:4200, as expected) and destroys the session (verified this by checking Sessions in Keycloak UI console). However, when I click Sign in with Custom IDP at the login page, it doesn't show the Spring Authorization Server's form login page to input user credentials and directly takes me into the application which is not the expected behavior in my case.
As a next step, I configured the Logout URL in the custom IDP's configuration in Keycloak to point to the Spring Authorization Server's default logout endpoint i.e., http://localhost:9000/logout and updated the WebSecurityConfig class to call logout(). However, when the end-user initiates the logout process, Keycloak's end-session-endpoint is called after which Spring Authorization server's logout endpoint is called which redirects the user to the same logged in page. Also, Keycloak doesn't destroy the session this time.

@Bean
@Order(Ordered.LOWEST_PRECEDENCE)
public SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception {

     http.csrf(csrf -> csrf.disable())
             .authorizeHttpRequests(
                     authorize -> authorize.mvcMatchers("/redis/**").permitAll().anyRequest().authenticated())
             .formLogin(form -> form.loginPage("/login").permitAll())
             .addFilterAfter(cookieFilter, ChannelProcessingFilter.class)
             .logout((logout) -> logout.invalidateHttpSession(true).clearAuthentication(true)
                     .logoutSuccessUrl("http://localhost:4200").permitAll());

     return http.build();
 }

One solution that I implemented in the Spring Authorization Server was to delete the user that gets created in Keycloak (by calling the delete by user ID Keycloak API) which destroys the session and brings me back to the login page. This time when I click on Sign in with Custom IDP, I am able to view the form login page for providing user credentials but I am totally unsure if I should be deleting users created in Keycloak just to terminate a session.

It would be really helpful if someone can explain where I might be going wrong as I am relatively new to this concept.
Also, I have disabled BackChannel Logout and FrontChannel logout mechanisms on Keycloak for my custom IDP.

Navigation Menu

Repository navigation

Keycloak: Identity Broker Logout not working as expected #15755

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Keycloak: Identity Broker Logout not working as expected #15755

Uh oh!

nehacharya04 Nov 29, 2022

Replies: 0 comments

nehacharya04
Nov 29, 2022