You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Identity-provider initiated single-logout doesn't work with strict 3. party cookie policy and front-channel logout
#15897
With the specification in mind, consider the following scenario:
We configure Keycloak with an external identity-provider that also has single-sign-on capabilities
A user logs in though a Keycloak client using said identity provider. Now we have an active session managed in both Keycloak and the external identity provider.
The same user performs a logout from a client in the external identity-provider's circle of trust. This identity provider only supports front-channel logout.
I expect all sessions for this user to be terminated. Both in the external IDP and Keycloak.
I have the external IDP configured to request front-channel logout uris like this one: http://localhost:8080/realms/test/protocol/openid-connect/logout?initiating_idp=oidc&iss=https://oidc-ver2.difi.no/idporten-oidc-provider/&sid=PGKiMmSURLjyjruYUX5HP0PpqEWiBKMQtopjLIlSTpE
With blocked 3. party cookies, my browser will perform the above request, but won't attach the required cookies for Keycloak to recognize the session that wants to logout.
I believe this is a weakness in the front-channel logout specification. Specifically: Version 1, chapter 3. where it states that the OP (in this case, the external IDP), will use an i-frame to perform this 3. party logout request.
The spec mentions this weakness in chapter 4.1, and I dont think Keycloak handles this well for external IDP initiated logouts.
I believe Keycloak needs to look at the iss and sid query-parameters in case the cookie is missing. This is the endpoint im thinking of:
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Front-channel logout specification: https://openid.net/specs/openid-connect-frontchannel-1_0.html
With the specification in mind, consider the following scenario:
I expect all sessions for this user to be terminated. Both in the external IDP and Keycloak.
I have the external IDP configured to request front-channel logout uris like this one:
http://localhost:8080/realms/test/protocol/openid-connect/logout?initiating_idp=oidc&iss=https://oidc-ver2.difi.no/idporten-oidc-provider/&sid=PGKiMmSURLjyjruYUX5HP0PpqEWiBKMQtopjLIlSTpEWith blocked 3. party cookies, my browser will perform the above request, but won't attach the required cookies for Keycloak to recognize the session that wants to logout.
I believe this is a weakness in the front-channel logout specification. Specifically: Version 1, chapter 3. where it states that the OP (in this case, the external IDP), will use an i-frame to perform this 3. party logout request.
The spec mentions this weakness in chapter 4.1, and I dont think Keycloak handles this well for external IDP initiated logouts.
I believe Keycloak needs to look at the iss and sid query-parameters in case the cookie is missing. This is the endpoint im thinking of:
keycloak/services/src/main/java/org/keycloak/protocol/oidc/endpoints/LogoutEndpoint.java
Line 161 in f4e91a5
Thoughts?
All reactions