Repository navigation
Replies: 7 comments 11 replies
|
I think your proposal is also aligned with the specs, right? IIRC, there you should ask for confirmation whenever the I agree that introducing a new option is not needed. |
|
Yes, exactly. This is aligned with the specification. Thanks Pedro! |
|
I am a little late to the party, but the way I understand the spec it totally makes sense to ask the user for confirmation if only the client_id is provided while not asking when it is the id_token_hint as this means the user must have given the ID token to the client before. Just don't forget to "When both client_id and id_token_hint are present, the OP MUST verify that the Client Identifier matches the one used when issuing the ID Token." ;) |
|
@sschu Yes, good point. This is already covered in latest keycloak main branch. |
|
Hello, But to re login again , user has to put fresh url in browser. to get login page. also in Client options "Front Channel Logout" or/and Backchannel Logout url" mentioned and in keycloak logs can see DEBUG [org.keycloak.services.managers.ResourceAdminManager] (default task-58) logout success for http://ip:port/ams/index.jsp: true But Login did not come until page is refreshed manually. Thanks in Advance. |
|
Thanks for the feedback. The new option If you include Just a note that this will be available in Keycloak 19. In Keycloak 18, you might include ID Token from id_token_hint and/or post_logout_redirect_uri, but this is more complicated if you don't have an option to include proper ID Token when calling this endpoint. |
|
Can you guide , how to fetch "id_token_hint" in java is this the way to get it When the user is redirected to the endpoint, they will be prompted if they really want to sign-out. This prompt can be bypassed by a client sending the original id_token received from authentication. This is passed as a query string parameter called id_token_hint." |
|
For Keycloak version 18 will ask for "do u want to logout" Java Code with another option tried This will show login page again. (Which is good ) But if we Login again , and reuse the old id_token_hint (which i printed and copied on browser Is this the correct approach ? |
|
@rutuparna-java You can try latest Keycloak nightly build https://github.com/keycloak/keycloak/releases/tag/nightly . It already contains the added support for
Let me know if you see any issues with latest build. |
|
We are able to do logout in one application(it will ask for confirmation ). for BackChannel, can you guide what steps need to be performed. In Below keycloak logs we can see, user explicitly logout app2. org.keycloak.services.managers.AuthenticationManager] (default task-20) backchannel logout to: App1 |
|
Hi @mposolda , can you guide on above points |
|
@rutuparna-java I may missed some details of your use-case and what exactly is going on. It seems that you are using Keycloak adapters in both of your applications. So it is about of configuration of the adapter, Keycloak client and the web application of App1. You should make sure that the code-to-token request sent from App1 during login, uses the parameter Anyway, your isue is not directly to the "RP Initia 8000 ted logout", but rather to the "Backchannel logout", so a bit unrelated to this issue. |
|
Both App1 and App2 are same code/ear/war only context name is different.
…On Fri, 10 Jun 2022, 13:00 Marek Posolda, ***@***.***> wrote:
@rutuparna-java <https://github.com/rutuparna-java> I may missed some
details of your use-case and what exactly is going on. It seems that you
are using Keycloak adapters in both of your applications. So it is about of
configuration of the adapter, Keycloak client and the web application of
App1. You should make sure that the code-to-token request sent from App1
during login, uses the parameter client_session_state with the ID of the
HttpSession of your "appplication session" . It seems that it does not use
that in your case (not 100% sure why). If App1 does not work and App2
works, it is probably best for you to investigate the difference between
them and make sure that App1 uses same/similar configuration and
environment as App2.
Anyway, your isue is not directly to the "RP Initiated logout", but rather
to the "Backchannel logout", so a bit unrelated to this issue.
—
Reply to this email directly, view it on GitHub
<#12183 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AQJKJWEMSHZ2BMTPNTAKA2LVOLVKXANCNFSM5W5DH7PQ>
.
You are receiving this because you were mentioned.Message ID:
***@***.***>
|
|
@mposolda 1 > app1 url : http://HaProxyIp:Port/App1 http://HaProxyIp:Port/auth/realms/apci/protocol/openid-connect/auth? 2 > After successful validation at keycloak end it opens application main page. As u suggested added client_session_state 4 > In App 1 or App2 , if we do Logout then the application In Logs after adding Client_session_state can see both apps got the session id logout resource App1 url: http://IP:PORT/App1 sessionIds: [35GqzYw66xjqSe78qfYCxfeVBPSBhhwHj4ZE2ym0] Can you guide on Point 4. |
|
For Workaround , we have added javascript "refresh" code in Login.ftl , so when application makes logout and if there are many iframes like Menu, header, body page .instead of 3 login page, now due to refresh java script it will show single page. |
|
Hi, regarding the last paragraph
Is there any plan for implementing it or is there a different way to show the logout confirmation page if we are using the Keycloak.js adapter? Looking trough the adapter it looks like it's always attaching the id_token_hint but not sure if I'm looking at the right place :) keycloak/js/libs/keycloak-js/src/keycloak.js Line 494 in 1145568 |
|
Hello! Do you have an idea for this problem? I mean... We all know that the user has soooo much settings. But this one more settings to disable this confirm dialog will be needed in our case.. Thx in advance and have a nice day! Florian |
|
@Flo0806 I happen to be in the same situation and have decided to go for client_id with confirmation screen. Did you managed to figure out how to get the id_token_hint in a setup where oauth2proxy handles all the authentication flow? Did you find any documentation about this? Googlesearch only yields blog posts and GH issues for me :D. |
Uh oh!
There was an error while loading. Please reload this page.
With the changes in Keycloak 18 around the support of RP-Initiated Logout, we introduced the "Logout confirmation screen", which can be displayed to the user. The logout confirmation screen is currently displayed in case that any of these is true:
id_token_hintis not sent to the logout endpointid_token_hintparameter has "Consent Required" set to trueNote that for clients with "Consent Required", the logout confirmation is currently always displayed and it is not possible to disable it. This may not be ideal behaviour as some clients may want to display consent screen during login (EG. Screen "Do you really want to grant application XY access to your email and profile?"), but they may not want to display logout confirmation screen during logout. And vice-versa. For example see this issue reported: #11915
Solution
The possibility is to introduce dedicated flag like "Confirm Logout" . But this will add another flag to the client to already large amount of other client options.
So better solution might be to leverage parameter
client_id, which was added few weeks ago to the latest draft of OIDC RP-Initiated Logout https://openid.net/specs/openid-connect-rpinitiated-1_0.html#RPLogout . This allows some flexibility as now it is possible to reference client used for thepost_logout_redirect_uriby theclient_idparameter. In the previous draft, there was hard requirement to sendid_token_hintin case you send alsopost_logout_redirect_urito be able to identify client, butid_token_hintis used also as a CSRF token to allow skip the logout confirmation screen. So it was not possible to have automatic redirect after logout without sending CSRF token (id_token_hint). Now it is possible.So what we can do is:
id_token_hintis sent, we will always skip "Logout confirmation screen" (even if client has "Consent Required" set to true)id_token_hintis not sent, we will always display logout confirmation screen. People can still have automatic redirect after logout by sending justclient_idwithpost_logout_redirect_uri.So if client wants user to confirm logout, it can avoid sending
id_token_hint.We can add option to keycloak.js adapter to
logoutmethod likeskipIdTokenHint, which will cause adapter to not sendid_token_hintto Keycloak during logout and hence enforce that logout confirmation screen is displayed. Similar for node.js adapter.All reactions