Repository navigation
|
Hi all, new to Keycloak and loving it so far, we have configured to run in Kubernetes with multiple IDP and everything works perfectly. Made use of lausbetz/apple-identity-provider-keycloak to get Apple IDP working. As we are building a mobile app we are not using http or https for Valid Redirect URIs scheme and have a custom in app scheme. When we login from the app we call endpoint (protocol/openid-connect/auth) and include redirect_uri=myappx%3A%2F%2Fcallback as query parameter. Keycloak responds with state,session_state and code which use then use to get access and identity token etc. Then when we logout we call endpoint (protocol/openid-connect/logout) with id_token_hint (from previous login) and post_logout_redirect_uri=myappx%3a%2f%2fcallback. This logs out the session as expected without log out prompy and the mobile app updates it state etc. Just tried to upgrade to version 19.0.1 and are experiencing issues with logout. It seems in this version when we call logout with post_logout_redirect_uri=myappx%3A%2F%2Fcallback KeyCloak comes back with error 400 message "Invalid redirect uri". It is strange as it seems happy to log in with redirect_uri myappx://callback but doesn't allow the log out. This all leads to the question is the error expected in version 19.0.1 or is this a bug or is there extra config required in 19.0.1? The exact same code works perfectly in 18.0.2. It seems like the Valid Redirect URIs custom scheme is allowed for login and not for logout. As an experiment we can remove the post_logout_redirect_uri parameter and the session does end but has bad implications within the application we are building as the redirect info is missing and breaks the application. Any advice would be much appreciated! |
Replies: 2 comments 3 replies
|
Are you also passing the ID token as id_token_hint? This is mandatory now, you cannot use post_logout_redirect_uri alone anymore. - unless you enable the legacy mode. Just check the code at |
|
Hi, |
|
Many thanks, I have just realised I cannot see the post log out option as running the old theme. I expect if I run the new UI I will find the setting and all will be good. Post which mentions this (scroll to end): Support for post_logout_redirect_uris in OIDC client registration |
|
We're using 19.0.1 of Keycloak, but I cannot find this Valid Post Logout Redirect URIs option. Can anyone tell me, where to find it? |
|
It is included in 19.0.2. |
Hi,
In KC 19, the valid logout URIs are defined separately, they can differ from the valid login URIs:
Cite from the release blog post https://www.keycloak.org/2022/07/keycloak-1900-released:
"Configuration option Valid Post Logout Redirect URIs added to the OIDC client. This change is aligned with the OIDC specification, which allows you to use a different set of redirect URIs for redirect after login and logout. Value + used for Valid Post Logout Redirect URIs means that the logout will use the same set of redirect URIs as specified by the option of Valid Redirect URIs. This change also matches the default behavior when migrating from a previous version due to backwards compatibility."