[keycloak-user] How to logout

[Ryan Slominski]

Hi Keycloak Users,

I'm using the Wildfly client adapter and trying to logout of Keycloak, even if a client application container doesn't think it is logged in.  This is a problem because login state with Keycloak and login state with JSESSION_ID in servlet container are two separate things that can get out-of-sync.  The documentation says you can logout in one of two ways:

1. Call HttpServletRequest.logout()
2. Navigate to URL http://auth-server/auth/realms/{realm-name}/protocol/openid-connect/logout?redirect_uri=encodedRedirectUri

See: https://www.keycloak.org/docs/latest/securing_apps/index.html#logout

The first appears to be a no-op because the Java container itself isn't logged in, in this case.  This does work if the client container is aware that it is logged in, but doesn't otherwise.  The second also doesn't seem to do anything and just redirects back to redirect_uri.  Any tips?

A forceful logout is useful in the scenario when one client (client A) logs into Keycloak, and a different client (cilent B) wants to forcefully logout as to switch users.  In this scenario client B doesn't think it is logged in because the client adapter is using container managed security with JSESSIONID, and locally the client isn't logged in.  However if a login was attempted it would succeed automatically without prompting for a username and password and therefore the user wouldn't get a chance to provide an alternate username.  A switch user ability is useful when users need to login with separate admin credentials or also in scenarios where a user says "move over and I'll drive" to a colleague.

Thanks,

Ryan