Repository navigation
Replies: 2 comments 4 replies
|
Thank you for your fast reply! The config matches your recommendation. We enabled extended logging as mentioned here, but took FYI: We are on 24.0.3 This leads us to the following log entries when logging out of ExternalApp: I'm confused why |
|
@TheVaan Good afternoon. Did you find the URL that needs to be configured in the IDP in the Backchannel Logout URL field? I'm having the same problem right now, and authentication via Backchannel Logout isn't working. Thank you. |
|
Hey @luigui489, I am answering on behalf of @TheVaan. I am not quite sure what the error was, but I think it was our Identity Provider configuration. Make sure you have set the following fields like in the image. Referring to the field from above, Backchannel logout URL. I cannot say if we entered a value there. We deactivated the login via the other identity provider and are not using it for now...maybe we removed that line. But like now it is empty and the Backchannel logout session required checkbox is selected. However, I think we only had a misconfiguration regarding the endpoints. Check that in your Keycloak instance. If it does not fix your problem, I also recommend starting 2 minimal Keyloak instances locally and try to integrate the second into the first one. That helps you to understand how the systems need to collaborate. This video is pretty old, but it helped me a bit doing that (https://www.youtube.com/watch?v=YIgkIBaTGFE) |
|
Hey @ittaq Thanks for your response, I was able to establish a connection between the two KeyCloaks by configuring the URLs as shown in the image. Authentication through the identity provider works correctly. The problem is that when I log out of the identity provider, the session in the identity broker remains. I think this is more related to the Backchannel URL field. I've tried the URLs https:///realms//protocol/openid-connect/logout and https:///realms//protocol/openid-connect/logout/backchannel, but they don't work. In the case of the URL https:///realms//protocol/openid-connect/logout, the logout backchannel causes a POST request to be sent to the broker to log out. However, the broker responds with an HTML request to confirm the logout. In this case, it should not ask for logout confirmation. https:///realms//protocol/openid-connect/logout/backchannel When using this URL, a BadRequest error occurs. It appears that this API is not suitable for requesting a logout from the identity provider to the broker. This is the configuration on the client side of the identity provider. |
|
Hey @luigui489 , did you try these settings as well? In your post you only used /logout and /backchannel. Did you also try backchannel-logout? Keycloak A -> App A -> Backchannel logout URL: Keycloak B -> App B -> Backchannel logout URL: |
Uh oh!
There was an error while loading. Please reload this page.
Hey there,
we have the following setup:
OurApp -> OurKeycloak -> External-Identity-Provider -> ExternalApp
In cooperation with the owner of the External-Identity-Provider, we want to backchannel logout vice versa through all apps. We activated backchannel-logout for the IDP and in our realms client.
After logging into OurApp by using External-Identity-Provider and then logging into ExternalApp using External-Identity-Provider too, we logout OurApp what results in being logged out of ExternalApp as desired.
But when (after logging into both apps via IDP) and logging out of ExternalApp, we are still logged in in OurApp.
We don't know if we misconfigured something or our External-Identity-Provider partner. They asked us for backchannel url and we gave them
https://our-keycloak.url/realms/{our-realm}/protocol/openid-connect/logout/backchannel-logoutas mentioned in Docs: Keycloak server OIDC URI endpoints.Could someone please help us solving this problem?
All reactions