Repository navigation
Keycloak 18.0.2 problem with post_logout_redirect_url and missing id_token_hint #16581
Replies: 3 comments 3 replies
|
You can enable the old behaviour, see https://www.keycloak.org/2022/04/keycloak-1800-released (section OpenID Connect Logout). |
|
Yes i know but here you have to provide the old |
|
You don't have to use |
|
You will get a logout confirm screen if you do not provide an id_token_hint. Any solution where the client doesn't have access to the id_token (Anything behind an AWS ALB, for example) will struggle without the legacy logout options and will be FORCED to use the logout confirm screen if the current situation doesn't change. I have a thread here: #15884 where I am hoping @stianst will add his thoughts. It is not really Keycloak's problem that some people aren't getting the id_token. It is certainly part of the token set that is provided through the Keycloak OIDC code flow. It is just dropped on the floor by AWS ALB and, I assume, other OIDC services. This needs addressing or Keycloak 23 release and the removal of legacy logout support will cause a lot of headaches. |
|
Further. You may need to upgrade THROUGH 18 to 19 to faciitate a flag where you can disable the logout confirm screen. Using this is conjunction with the legacy flag for the redirect means logout UX will not change.... |
|
Exactly, this is the name of the switch: |
Uh oh!
There was an error while loading. Please reload this page.
We have a keycloak instance running which received an update from 15 to 18.0.2.
According to the specs
https://openid.net/specs/openid-connect-rpinitiated-1_0.html
There is a RECOMMENDED id_token_hint which should be provided along the post_logout_redirect_uri parameter to avoid unauthorized logout from other sources. But it seems not mandatory.
However, since its complicated in our case to get the token id after application logout, we decided to not provide the id_token_hint but let the user click on the logout form that appears when no id_token_hint is provided and redirect them afterwards.
But it seems not to work with
http://keycloak.host/realms/test_realm/protocol/openid-connect/logout?post_logout_redirect_uri=https%3A%2F%2Ftest.redirect.com%2F&state=123be78239823baa239328ef&scope=profile%20email&response_type=code&approval_prompt=auto&client_id=test-client
The error is
Like mentioned, we don't have the id_token here we could provide.
Strange is, that on another keycloak server but with the same version 18.0.2, the url is working correctly and the prompt appears. Unfortunately we can't find any difference in config. Is there some config in keycloak which will influence the described behavior somehow?
Any other ideas?
All reactions