Repository navigation
Replies: 2 comments 3 replies
|
On further investigation I can see another flag in KC19 to suppress the logout confirmation. I guess upgrade straight through to 19.0.2 and use that.... |
|
The main question here is for @stianst Is it an option to continue support of the legacy logout options beyond Keycloak 23 if no solution comes from AWS ALB with regards to supporting passing down the id_token? |
|
The id_token_hint is important for a few reasons:
For these reason it is not possible to continue keeping the old behaviour as it is simply not a secure option. One note here in terms of 1 is that we did scan all clients to validate the redirect uri, but that has a huge performance implication (if I'm not mistake this is already removed, if not will be removed). I would suggest going back to AWS and refer to the https://openid.net/specs/openid-connect-rpinitiated-1_0.html specifications, and also highlight some of the security concerns listed above in this regard (specifically the fact that any application can generate a link that will logout the user). |
|
@mposolda @pedroigor FIY |
|
If |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Hi there,
We have client services that use AWS and an ALB to service the OIDC Code Flow. The ALB only passes the Access and Refresh tokens downstream per https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-authenticate-users.html
The Keycloak 18+ logout journey now REQUIRES id_token_hint to be passed in as a parameter and, otherwise, errors.
Is there a way to use Keycloak 18+ with an AWS ALB (or any other OIDC service that doesn't pass the id_token down)
We have implemented the legacy flag in the mean time...
spi-login-protocol-openid-connect-legacy-logout-redirect-uri=true... but want to avoid the confirm screen and just logout to the redirect URL with
post_logout_redirect_uri=======UPDATE POST KC 19 UPGRADE=========
We have a working logout journey but there is increasing concern that the legacy logout options that we are using are going to be removed in Keycloak 23.
AWS still have no apparent intention to add id_token to the properties passed downstream from ALB when this is used to facilitate OIDC. They do pass the access and refresh tokens. They specifically note that they DO NOT pass the id_token. We have an open support request with them to try and get this supported. In the mean time there is a fear that we will not be able to logout correctly with Keycloak unless the legacy support persists until they support it.
Would love to know your thoughts @stianst and co.
Thanks in advance.
Tom.
All reactions