OIDC Identity Provider Logout - How does it work? #20907

xgp · 2023-06-10T11:17:35Z

xgp
Jun 10, 2023

Cross-posting from https://keycloak.discourse.group/t/oidc-identity-provider-logout-how-does-it-work/22554

I'm looking for some clarification on how the OIDC Identity Provider Logout URL is used. In the tooltip in the UI, it indicates:

End session endpoint to use to logout user from external IDP.

In the documentation, there is a similarly vague explanation:

When logging out, Keycloak sends a request to the external identity provider that is used to log in initially and logs the user out of this identity provider. You can skip this behavior and avoid logging out of the external identity provider. See adapter logout documentation for more information.

which links to information about the Java adapter.

My questions are:

what is the actual function of that URL?
when, in a logout flow can we expect it to be called?
are there specific ways we must initiate a logout in order to use this facility?

My experience in using this, is that when logging out of a Keycloak client using the normal OIDC logout URL (generated by the keycloak-js lib), this URL never gets called (either by Keycloak or by the browser) when the user entered through an OIDC IdP. I read the OIDC logout specs, and looked at the Keycloak code for this, and I can't figure out which this is supposed to implement, and where the logout URL actually gets used.

It looks like the keycloakInitiatedBrowserLogout method from IdentityProvider is what is supposed to do the work:

https://www.keycloak.org/docs-api/21.1.1/javadocs/org/keycloak/broker/provider/IdentityProvider.html#keycloakInitiatedBrowserLogout(org.keycloak.models.KeycloakSession,org.keycloak.models.UserSessionModel,javax.ws.rs.core.UriInfo,org.keycloak.models.RealmModel)

which for OIDCIdentityProvider looks like this, with some conditional logic to either perform a backchannel or redirect, depending on configuration:

https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/broker/oidc/OIDCIdentityProvider.java#L166

All of this is called in the AuthenticationManager here:

https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/services/managers/AuthenticationManager.java#L652

My confusion is still, under what conditions would this get called? Which, by looking at the AuthenticationManager code can be translated to, under what conditions would there be a user session note with key Details.IDENTITY_PROVIDER and a logout auth session note with key AuthenticationManager.LOGOUT_INITIATING_IDP not the same as the former?

        String brokerId = userSession.getNote(Details.IDENTITY_PROVIDER);
        String initiatingIdp = logoutAuthSession.getAuthNote(AuthenticationManager.LOGOUT_INITIATING_IDP);
        if (brokerId != null && !brokerId.equals(initiatingIdp)) {

Navigation Menu

Repository navigation

OIDC Identity Provider Logout - How does it work? #20907

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

OIDC Identity Provider Logout - How does it work? #20907

Uh oh!

xgp Jun 10, 2023

Replies: 0 comments

xgp
Jun 10, 2023