Repository navigation
Replies: 4 comments 1 reply
|
Don't see a problem with that. Would it be a per-realm or per-client option? |
0 replies
|
Sounds like a logout flow feature? Half kidding, half serious ... I'd say if it is a compliance issue, you might want it to behave the same for all clients. At the same time, there are the usual exceptions, so people might be ok to have it per-client. |
0 replies
|
I'd probably go for per-realm or maybe do it as a client policy. |
1 reply
|
I thought about introducing this per-client as it already has a logout configuration section, where this functionality naturally falls in. Once we have a per-client configuration option, we could enforce it across the Realm using Client Policies. What do you think about such an approach? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Hey @stianst @mposolda @ahus1 👋🏻
Keycloak's implementation of the OIDC Logout Spec provides a frictionless way to log user out without displaying a logout confirmation. In other words, once the application initiates the logout and provides
id_token_hint,client_idas well aspost_logout_redirect_uri, Keycloak silently logs a user out and finishes the entire flow with sending a redirect to Post Logout Page.However, there are some compliance requirements such as ASD STIG that require presenting a confirmation screen to the user.
I wanted to check if you'd be open to introduce a new configuration option to Keycloak in the Client Logout options section that would enforce presenting such a confirmation screen. This approach would greatly help up fulfilling all the compliance requirements for the UDS Platform.
UDS Core tracker: defenseunicorns/uds-identity-config#689
All reactions