<p dir="ltr">Hi bill,</p>
<p dir="ltr">Are you using 2 applications for testing?</p>
<p dir="ltr">If yes, need to know have you logged out the first application then redirect to keycloak login page? After that refresh the second application then redirect to keycloak login page?</p>
<p dir="ltr">Can i know which version of picketlink federation lib are you using?</p>
<div class="gmail_quote">On Apr 6, 2015 8:56 PM, "Bill Burke" <<a href="mailto:bburke@redhat.com">bburke@redhat.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I tried out the saml demo app and logout works just fine, so I'm guessing this is a bug in the PL SP Filter.<br>
<br>
On 4/6/2015 6:47 AM, Chen Keong Yap wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi bill,<br>
<br>
Global logout only removed sp sessions but not web application sessions<br>
and this created security loopholes.<br>
<br>
Please advise<br>
<br>
On Mon, Apr 6, 2015 at 6:41 AM, Chen Keong Yap <<a href="mailto:chenkeong.yap@izeno.com" target="_blank">chenkeong.yap@izeno.com</a><br>
<mailto:<a href="mailto:chenkeong.yap@izeno.com" target="_blank">chenkeong.yap@izeno.<u></u>com</a>>> wrote:<br>
<br>
Guys,<br>
<br>
Can share your ideas why global logout is not working?<br>
<br>
On Apr 3, 2015 3:47 PM, "Chen Keong Yap" <<a href="mailto:chenkeong.yap@izeno.com" target="_blank">chenkeong.yap@izeno.com</a><br>
<mailto:<a href="mailto:chenkeong.yap@izeno.com" target="_blank">chenkeong.yap@izeno.<u></u>com</a>>> wrote:<br>
<br>
Hi Marek,<br>
<br>
I've just tested backchannel logout and it's showing same issue.<br>
Both applications are using PL SP Filter and the steps below are<br>
used for testing.<br>
<br>
1. Open <a href="https://localhost:8443/employee/" target="_blank">https://localhost:8443/<u></u>employee/</a> and http request is<br>
redirected to<br>
<a href="https://localhost:8443/auth/realms/saml-demo-1/protocol/saml" target="_blank">https://localhost:8443/auth/<u></u>realms/saml-demo-1/protocol/<u></u>saml</a><br>
<br>
2. Enter username and password into keycloak login page and<br>
redirected to employee landing page<br>
<br>
3. Open <a href="https://localhost:8443/sales-post/" target="_blank">https://localhost:8443/sales-<u></u>post/</a> and redirected to<br>
sales-post landing page without login<br>
<br>
4. Logon to keycloak admin console and noticed there are 2<br>
active sessions<br>
<br>
5. Perform global logout from employee landing page<br>
(<a href="https://localhost:8443/employee/?GLO=true" target="_blank">https://localhost:8443/<u></u>employee/?GLO=true</a>) and http request is<br>
redirected to<br>
<a href="https://localhost:8443/auth/realms/saml-demo-1/protocol/saml" target="_blank">https://localhost:8443/auth/<u></u>realms/saml-demo-1/protocol/<u></u>saml</a><br>
<br>
6. Logon to keycloak admin console and noticed all sessions are gone<br>
<br>
7. Refresh sales-post landing page and it's not redirected to<br>
keycloak login page. sales-post session still active.<br>
<br>
Kindly advise why GLO is performed but the second application<br>
(sales-post) session still active?<br>
<br>
On Fri, Apr 3, 2015 at 3:36 PM, Marek Posolda<br>
<<a href="mailto:mposolda@redhat.com" target="_blank">mposolda@redhat.com</a> <mailto:<a href="mailto:mposolda@redhat.com" target="_blank">mposolda@redhat.com</a>>> wrote:<br>
<br>
Switch the "Front channel logout" to off. In this case it<br>
should use backchannel (not redirecting through browser, but<br>
sending logout requests from Keycloak in background)<br>
<br>
Marek<br>
<br>
<br>
<br>
On 3.4.2015 08:28, Chen Keong Yap wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
Hi Merek,<br>
<br>
I've tried frontChannel logout in 1.2.0.Beta1 and it's<br>
giving me the same issues, please refer to the settings<br>
shown in the screen shot.<br>
<br>
Can you please advise how to test backchannel logout?<br>
<br>
<br>
Inline image 1<br>
<br>
<br>
<br>
On Fri, Apr 3, 2015 at 1:50 PM, Marek Posolda<br>
<<a href="mailto:mposolda@redhat.com" target="_blank">mposolda@redhat.com</a> <mailto:<a href="mailto:mposolda@redhat.com" target="_blank">mposolda@redhat.com</a>>> wrote:<br>
<br>
I would try to upgrade to latest 1.2.0.Beta1 as it has<br>
some related fixes AFAIK.<br>
<br>
In this version, you have also possibility to setup<br>
either frontChannel logout or backchannel logout for<br>
the application. It could be set in Keycloak admin<br>
console. I think that at least one of them will work<br>
with SP filter in latest version (if not both).<br>
<br>
Marek<br>
<br>
<br>
On 3.4.2015 01:44, Chen Keong Yap wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi,<br>
<br>
I've 2 applications installed with Picketlink<br>
SPFilter to authenticate with keycloak 1.1.0 beta 2.<br>
<br>
When i perform global logout, first application was<br>
logged out successfully because SP/keycloak session<br>
and application http session are removed but the<br>
problem is second<br>
application SP/keycloak session is removed but<br>
application http session is still remained. I've set<br>
admin url for these 2 applications in keycloak admin<br>
console. Kindly share your ideas.<br>
<br>
<br>
<br>
______________________________<u></u>_________________<br>
keycloak-user mailing list<br>
<a href="mailto:keycloak-user@lists.jboss.org" target="_blank">keycloak-user@lists.jboss.org</a> <mailto:<a href="mailto:keycloak-user@lists.jboss.org" target="_blank">keycloak-user@lists.<u></u>jboss.org</a>><br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" target="_blank">https://lists.jboss.org/<u></u>mailman/listinfo/keycloak-user</a><br>
</blockquote>
<br>
<br>
<br>
<br>
<br>
<br>
</blockquote>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
</blockquote>
<br>
-- <br>
Bill Burke<br>
JBoss, a division of Red Hat<br>
<a href="http://bill.burkecentral.com" target="_blank">http://bill.burkecentral.com</a><br>
</blockquote></div>