Repository navigation
Replies: 3 comments 1 reply
|
Short answer: SAML has no such parameter, and in a SAML logout that field isn't used. For an SP-initiated SAML logout, Keycloak sends the The field is on the SAML settings page only because the admin console renders it whenever "Standard flow" is enabled, without checking the protocol (LoginSettings.tsx), and new SAML clients get There is one place where it does matter: the OIDC end-session endpoint doesn't check the client's protocol either (LogoutEndpoint). So is validated against that list. I tried it on 26.8.1 (no active session): an allowed URI got a 302 to it, with |
|
Your great explanation of why the field is rendered in the GUI sounds like a bug report to me! What's worse is the inclusion in the Server Administration Guide. Before filing an issue (or perhaps you want to do that yourself?), I'd like to check that I am not missing anything. For example, do the "Valid post logout redirect URIs" perhaps apply to the RelayState and only the help and documentation are out of date? Thank you for your help! |
|
No, it doesn't touch RelayState either. Keycloak treats it as opaque: for an SP-initiated logout it stores the RelayState from the So I don't think you're missing anything; it's a UI/docs issue. A few things that may help if you file it:
Go ahead and open it; you've already got the whole picture. |
|
Thank you again! |
Uh oh!
There was an error while loading. Please reload this page.
When configuring a SAML client in Keycloak 26.8.1, the "Settings" tab offers the option "Valid post logout redirect URIs" and the associated help window explains: "Valid URI pattern a browser can redirect to after a successful logout."
For an OIDC client, where the same option is available, it makes perfect sense as a validation pattern for the value of the request's post_logout_redirect_uri parameter.
I am not aware of an analogous redirect parameter for SAML LogoutRequests. Is there such a thing? In the spec? In Keycloak? The Server Administration Guide does not seem to mention anything of the sort.
This discussion also asks about the "Valid post logout redirect URIs" option. But it either concerns an older version of Keycloak or it seems to misinterpret the override options for binding URLs in the "Advanced" tab.
Many thanks!
M.
All reactions