Repository navigation
IdP config option 'Backchannel logout' in fact executes RP initiated logout and should be renamed
#13707
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
An OpenID Connect Identity Provider configured at Keycloak can have the option "Backchannel logout enabled".
If enabled, Keycloak calls the IdP endsession endpoint with id_token_hint as described at OpenID Connect RP-Initiated Logout 1.0.
This request is executed from Keycloak backend, but it is not a backchannel logout as described in OpenID Connect Back-Channel Logout 1.0.
Relevant code:
keycloak/services/src/main/java/org/keycloak/broker/oidc/OIDCIdentityProvider.java
Line 132 in 89795cf
The config option seems to misnamed. It can be easily confused with the Backchannel logout protocol for logout of relying parties.
The tooltip is completely misleading, as it is irrelevant if the IdP supports backchannel logout as defined by the specs. It needs to support the id_token_hint parameter recommended at OpenID Connect RP-Initiated Logout, section 'RP-Initiated Logout'
Proposal for improvement at Admin console
When disabled, Keycloak redirects the browser to the logout URL of the external IdP. When enabled, the request to the logout URL is executed form Keycloak backend and includes the parameter id_token_hint.
All reactions