Repository navigation
Logout Single Device #28730
Replies: 2 comments
|
From #27815, I've tested that you can indeed use the legacy backchannel logout method to sign out of an individual offline session. You can use this instead of Would appreciate input from a maintainer on whether or not an API exists for deleting an Offline session by its ID on the admin API. It only works for Regular SSO sessions, despite the Offline session sharing the same session ID. When attempting to delete an entry for an Offline session from the admin UI, Keycloak first deletes the Regular SSO if it exists, and then returns 404 on subsequent requests. I currently use offline tokens to allow apps—primarily native mobile applications—to stay signed in indefinitely. It would be nice if at the client level, I could configure the following:
I have a similar use case mainly focused on end-user device management. I'd like to provide the following experiences within a platform of apps:
Are any of the 10000 above possible? It seems like (2) and (3) come with gotchas due to limitations on offline session management. |
|
I think this might relate to #27815 At least regarding logging out on a specific device. |
Uh oh!
There was an error while loading. Please reload this page.
Logout Single Device
tldr: Is there a way to configure Keycloak to only logout a single device?
Scenario
A user is logged in on two devices, e.g an Android smartphone and an Android TV.
Both devices were logged in using the same browser on the smartphone (Android App via custom Chrome tab, Android TV via device code).
Now, if the user logs out on the smartphone, the TV client session is logged out as well.
What we need is a way to revoke a user session only on a single client device.
I.e. logging out on the smartphone should kill THAT session on THAT device for THAT user only.
The TV client session should continue to be logged in.
Behaviour
Current Behaviour
Unfortunately, neither
/logoutnor/revokeoffer what we need as far as we know:/logoutendpoint kills a user session and related client sessions/revokeendpoint kills all sessions of a specific client on all devices/revoked1 c2/logoutd1 c2The warning signs highlight logouts that we would like to prevent.
Desired Behaviour
Here is the behaviour we're looking for:
/revoked1 c2/logoutd1 c2Considerations
We also considered the following alternatives:
Any ideas how we can achieve the desired behaviour?
All reactions