Repository navigation
Keycloak IDP forwarded auth does not redirect to front-channel logout URL #13480
Unanswered
tgerakitis
asked this question in
Q&A
Replies: 1 comment
|
Same happens for me. When i call /logout it automatically logs me in with my IDP provider |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
- 7A51
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Situation
For my web application, I have set up a keycloak (v19.0.0) realm with an external SAML IDP.
After successfully logging in, the application is using its own cookies (I can't change this since this is an external piece of software) and has a logout endpoint to destroy those cookies when visited through the browser.
In the corresponding client configuration, I set a front-channel logout URI to be called by the browser whenever a logout is triggered from the IDP.
Problem
When triggering the single sign-out from keycloak itself using this "https://baseurl/realms/my-realm/protocol/openid-connect/logout"`, keycloak successfully logs out from the IDP and destroys its own cookies but does not redirect to the front-channel logout URI, which leaves the app in a logged-in state. I tested this without an IDP enabled and it logged me out from my app.
Question
How can I force keycloak to trigger the front-channel logout URI on a single sign-out request?
All reactions