Repository navigation
Replies: 4 comments
|
+1 to the issue. Our application is heavily built around user sessions, which was why we chose Keycloak in the first place. Behavior, where the user logs out from one device and automatically loses all sessions is unbelievably stupid, since legacy logout works perfectly fine, killing the session that the token was bound to. |
|
This is also the case in Keycloak v25.0.6 I too can't quite grasp the reasoning behind this. It might make sense on a single device and if all applications are under the same hood or if SSO is explicitly wished. But I'm assuming this happens in the case of multiple devices as well (or would some other authentication flow be used in that case anyway?). |
|
+1. I would like it if logging out on one computer did not effect the user if they are logged in elsewhere, is there a recommended way to do this? |
Uh oh!
There was an error while loading. Please reload this page.
My use case is about maintaining multiple sessions for the same client and same user, and programmatically closing them, independently of each other. I understand that refresh tokens are bound to sessions. Every time I obtain a new token pair, I can see a new session being created and tokens can be refreshed independently: all good so far.
However, when I revoke only one of the refresh tokens (using the revoke endpoint), both sessions are terminated, invalidating all tokens. I can see the exact same behaviour with both "normal" refresh tokens and offline tokens. (This looks like the same problem as described in #26532. I can see the same with 23.0 and not only with offline tokens.)
Here is the full test I did:
grant_type=password, default scopes.grant_type=password(same request, same client, same user, etc. as before)./admin/master/console/#/{realm}/clients/{client}/sessions).POST /realms/{realm}/protocol/openid-connect/revokewithtoken={first refresh token}).grant_type=refresh_tokenrequest fails with "Session not active".After a lot of digging around, I found an alternative method, the "legacy logout endpoint": changing step 4 above to
POST /realms/{realm}/protocol/openid-connect/logoutwithclient_id={client id}, client_secret={client secret}, refresh_token={refresh token}only closes the session corresponding to the given token, all other sessions remain intact - exactly what I initially expected!I don't think this second method is documented (any more), and the newly intended usage of the logout endpoint seems to be for OIDC front-channel logout only (by redirecting the user agent to that endpoint, not by calling it from a backend with client credentials). So far I could only find some mentions of this "legacy" way here: https://www.keycloak.org/docs/latest/upgrading/index.html#openid-connect-logout - and here, in the code: https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/protocol/oidc/endpoints/LogoutEndpoint.java#L330
Is it intentional for token revocation to invalidate every session, not just a specific token? (If we think about the two tokens being equivalent as they represent the same exact grant, it can kind of make sense, but I can't see this documented anywhere.)
Is the "legacy" logout method officially supported?
Is there any other/better way to manage concurrent sessions independently?
All reactions