Repository navigation
Replies: 2 comments
|
I think this is intended behavior, though the UX is definitely confusing. The The confusion comes from the empty-field semantics. When "Valid post logout redirect URIs" is left empty, Keycloak falls back to the "Valid redirect URIs" list at runtime (during actual logout flows). But the client policies executor validates the stored configuration, and an empty field doesn't get resolved to the redirect URIs before validation — it likely sees an empty list and moves on. The error you're hitting is probably because If you want post-logout URIs to pass validation, you'll probably need to explicitly list them instead of relying on the empty-field fallback. You could also check if the |
|
Thank you @mg1986jp for your answer. I did some more debugging and I seems that it ois definitely intentional that the post-loguout URIs are checked bey the executor. At least there is the own method for checking the post-logut url so it seems quite intended: https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/services/clientpolicy/executor/SecureRedirectUrisEnforcerExecutor.java#L234 However, I think it is not intended that the empty post-logout url list (basically the default) would lead to an error. There is even a check to skip the verification when the But it looks like the problem is that the list is never empty but has just one entry (an empty string) when not post-logout URI is specified. This cause then that the verification happens for the empty string which causes the error. So, I think I will open an issue for that. The "+" wildcard seems to be also correctly handled by the executor. So set it to + would also be a possibile workaround to pass the policy verification. |
Uh oh!
There was an error while loading. Please reload this page.
I noticed that the settings of the
secure-redirect-uris-enforcerexecutor are also applied to post logout redirect URIs, and I am not sure if this is the intended behavior or if this happens by accident. It is especially confusing because, according to the description, the "Valid post logout redirect URIs" can be left empty:But then an error appears when updating the client:
Furthermore, I think, the error message "Invalid Redirect Uri: invalid uri" is a bit too generic. At first, I thought that the redirect URI was incorrect, which it was not. I was confused about why I got this error until I noticed that it was caused by the empty value of the post logout redirect URIs.
So, if this is the intended behavior, it should maybe be mentioned in the description of the executor and also result in a more precise error message, so it is clear what is wrong.
Thanks!
All reactions