Repository navigation
LOGOUT_ERROR with 'No user details' signing out from Entra Id Identity Provider #52047
Replies: 1 comment
|
The account picker you are seeing is not incidental — it is the same cause as the error, and it points at a setting. First, what the endpoint is actually doing. Keycloak sends its own user session ID as the String sessionId = userSession.getId();
UriBuilder logoutUri = UriBuilder.fromUri(getConfig().getLogoutUrl())
.queryParam("state", sessionId);and on the way back it looks the session up by exactly that value, requiring it to still exist and to be mid-logout: UserSessionModel userSession = session.sessions().getUserSession(realm, state);
if (userSession == null) {
logger.error("no valid user session");
...
}
if (userSession.getState() != UserSessionModel.State.LOGGING_OUT) {
logger.error("usersession in different state");So Now the picker. Entra only asks which session to sign out of when it cannot tell which account is meant — that is, when no String idToken = getFederatedIdToken(userSession);
...
if (getConfig().isSendIdTokenOnLogout() && idToken != null) {
logoutUri.queryParam("id_token_hint", idToken);
}The setting has to be on, and a federated ID token has to be present on the session for Keycloak to have something to send. If either is missing the parameter is silently omitted, Entra falls back to asking the user, and you gain an extra interaction and redirect hop before the return leg — which is precisely where your flow breaks. So the first thing I would check on that identity provider is "Send 'id_token_hint' on logout", together with token storage so That still leaves why the session is gone, and your "first attempt worked, later ones didn't" detail is the useful clue there. Since you already have DEBUG on, compare
Those two want quite different fixes, and the log line you already have distinguishes them without any further reproduction. |
Uh oh!
There was an error while loading. Please reload this page.
I'm having some issues trying to sign out from Entra Id Identity Providers in Keycloak 26.5.0(and 26.4.x versions).
I've configured the identity provider using the https://login.microsoftonline.com/tenant-id/v2.0/.well-known/openid-configuration discovery endpoint.
Sign in works a treat, it's when I try sign out that I'm running into issues. below is a couple of lines of relevant logs:
The user is asked in Entra Id which session they'd like to sign out of, then when redirected back to Keycloak the error above is produced.
What's strange, is the first time I tried to sign in via Entra Id, then sign out I did not receive this error, it's only on subsequent attempts it appears to happen.
Any assistance would be greatly appreciated.
Thank you!
All reactions