<div dir="ltr">We also have a handful of non-JS and legacy applications which exhibit the same behavior. If a user session is logged out in the KC admin web interface, shouldn't the security proxy stop serving the protected app?<div><br></div><div>I've listed example security proxy and client configs below if that helps any.</div><div><br></div><div>Security proxy config:</div><div><br></div><div><br></div><div><font face="monospace, monospace"><br></font></div><div><div><font face="monospace, monospace">{</font></div><div><font face="monospace, monospace"> "header-names": {</font></div><div><font face="monospace, monospace"> "keycloak-username": "X-UserName"</font></div><div><font face="monospace, monospace"> },</font></div><div><font face="monospace, monospace"> "applications": [</font></div><div><font face="monospace, monospace"> {</font></div><div><font face="monospace, monospace"> "constraints": [</font></div><div><font face="monospace, monospace"> {</font></div><div><font face="monospace, monospace"> "authenticate": true,</font></div><div><font face="monospace, monospace"> "pattern": "/"</font></div><div><font face="monospace, monospace"> }</font></div><div><font face="monospace, monospace"> ],</font></div><div><font face="monospace, monospace"> "adapter-config": {</font></div><div><font face="monospace, monospace"> "realm": "dev",</font></div><div><font face="monospace, monospace"> "realm-public-key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4...",</font></div><div><font face="monospace, monospace"> "auth-server-url": "<a href="https://auth.dev.example.org/auth">https://auth.dev.example.org/auth</a>",</font></div><div><font face="monospace, monospace"> "resource": "<a href="http://fooapp.example.org">fooapp.example.org</a>",</font></div><div><font face="monospace, monospace"> "public-client": true</font></div><div><font face="monospace, monospace"> },</font></div><div><font face="monospace, monospace"> "base-path": "/"</font></div><div><font face="monospace, monospace"> }</font></div><div><font face="monospace, monospace"> ],</font></div><div><font face="monospace, monospace"> "http-port": "8107",</font></div><div><font face="monospace, monospace"> "bind-address": "0.0.0.0",</font></div><div><font face="monospace, monospace"> "send-access-token": true,</font></div><div><font face="monospace, monospace"> "target-url": "<a href="http://naked-fooapp.example.org">http://naked-fooapp.example.org</a>"</font></div><div><font face="monospace, monospace">}</font></div></div><div><br></div><div><br></div><div><br></div><div>Corresponding Keycloak client config:</div><div><br></div><div><br></div><div><font face="monospace, monospace"><br></font></div><div><div><font face="monospace, monospace">{</font></div><div><font face="monospace, monospace"> "webOrigins": [</font></div><div><font face="monospace, monospace"> "<a href="http://fooapp.example.org">http://fooapp.example.org</a>",</font></div><div><font face="monospace, monospace"> "<a href="https://fooapp.example.org">https://fooapp.example.org</a>"</font></div><div><font face="monospace, monospace"> ],</font></div><div><font face="monospace, monospace"> "useTemplateScope": false,</font></div><div><font face="monospace, monospace"> "useTemplateMappers": false,</font></div><div><font face="monospace, monospace"> "useTemplateConfig": false,</font></div><div><font face="monospace, monospace"> "surrogateAuthRequired": false,</font></div><div><font face="monospace, monospace"> "standardFlowEnabled": true,</font></div><div><font face="monospace, monospace"> "serviceAccountsEnabled": false,</font></div><div><font face="monospace, monospace"> "rootUrl": "",</font></div><div><font face="monospace, monospace"> "redirectUris": [</font></div><div><font face="monospace, monospace"> "<a href="https://fooapp.example.org/*">https://fooapp.example.org/*</a>",</font></div><div><font face="monospace, monospace"> "<a href="http://fooapp.example.org/*">http://fooapp.example.org/*</a>"</font></div><div><font face="monospace, monospace"> ],</font></div><div><font face="monospace, monospace"> "publicClient": true,</font></div><div><font face="monospace, monospace"> "enabled": true,</font></div><div><font face="monospace, monospace"> "directAccessGrantsEnabled": true,</font></div><div><font face="monospace, monospace"> "consentRequired": false,</font></div><div><font face="monospace, monospace"> "clientId": "<a href="http://fooapp.example.org">fooapp.example.org</a>",</font></div><div><font face="monospace, monospace"> "clientAuthenticatorType": "client-secret",</font></div><div><font face="monospace, monospace"> "bearerOnly": false,</font></div><div><font face="monospace, monospace"> "baseUrl": "<a href="http://fooapp.example.org/">http://fooapp.example.org/</a>",</font></div><div><font face="monospace, monospace"> "attributes": {</font></div><div><font face="monospace, monospace"> "saml_force_name_id_format": "false",</font></div><div><font face="monospace, monospace"> "saml.server.signature": "false",</font></div><div><font face="monospace, monospace"> "saml.multivalued.roles": "false",</font></div><div><font face="monospace, monospace"> "saml.force.post.binding": "false",</font></div><div><font face="monospace, monospace"> "saml.encrypt": "false",</font></div><div><font face="monospace, monospace"> "saml.client.signature": "false",</font></div><div><font face="monospace, monospace"> "saml.authnstatement": "false",</font></div><div><font face="monospace, monospace"> "saml.assertion.signature": "false"</font></div><div><font face="monospace, monospace"> },</font></div><div><font face="monospace, monospace"> "frontchannelLogout": false,</font></div><div><font face="monospace, monospace"> "fullScopeAllowed": true,</font></div><div><font face="monospace, monospace"> "implicitFlowEnabled": false,</font></div><div><font face="monospace, monospace"> "nodeReRegistrationTimeout": -1,</font></div><div><font face="monospace, monospace"> "notBefore": 0,</font></div><div><font face="monospace, monospace"> "protocol": "openid-connect",</font></div><div><font face="monospace, monospace"> "protocolMappers": [</font></div><div><font face="monospace, monospace"> {</font></div><div><font face="monospace, monospace"> "protocolMapper": "saml-role-list-mapper",</font></div><div><font face="monospace, monospace"> "protocol": "saml",</font></div><div><font face="monospace, monospace"> "name": "role list",</font></div><div><font face="monospace, monospace"> "consentRequired": false,</font></div><div><font face="monospace, monospace"> "config": {</font></div><div><font face="monospace, monospace"> "single": "false",</font></div><div><font face="monospace, monospace"> "attribute.nameformat": "Basic",</font></div><div><font face="monospace, monospace"> "<a href="http://attribute.name">attribute.name</a>": "Role"</font></div><div><font face="monospace, monospace"> }</font></div><div><font face="monospace, monospace"> },</font></div><div><font face="monospace, monospace"> {</font></div><div><font face="monospace, monospace"> "protocolMapper": "oidc-usermodel-property-mapper",</font></div><div><font face="monospace, monospace"> "protocol": "openid-connect",</font></div><div><font face="monospace, monospace"> "name": "given name",</font></div><div><font face="monospace, monospace"> "consentText": "${givenName}",</font></div><div><font face="monospace, monospace"> "consentRequired": true,</font></div><div><font face="monospace, monospace"> "config": {</font></div><div><font face="monospace, monospace"> "user.attribute": "firstName",</font></div><div><font face="monospace, monospace"> "jsonType.label": "String",</font></div><div><font face="monospace, monospace"> "id.token.claim": "true",</font></div><div><font face="monospace, monospace"> "<a href="http://claim.name">claim.name</a>": "given_name",</font></div><div><font face="monospace, monospace"> "access.token.claim": "true"</font></div><div><font face="monospace, monospace"> }</font></div><div><font face="monospace, monospace"> },</font></div><div><font face="monospace, monospace"> {</font></div><div><font face="monospace, monospace"> "protocolMapper": "oidc-usermodel-property-mapper",</font></div><div><font face="monospace, monospace"> "protocol": "openid-connect",</font></div><div><font face="monospace, monospace"> "name": "username",</font></div><div><font face="monospace, monospace"> "consentText": "${username}",</font></div><div><font face="monospace, monospace"> "consentRequired": true,</font></div><div><font face="monospace, monospace"> "config": {</font></div><div><font face="monospace, monospace"> "user.attribute": "username",</font></div><div><font face="monospace, monospace"> "jsonType.label": "String",</font></div><div><font face="monospace, monospace"> "id.token.claim": "true",</font></div><div><font face="monospace, monospace"> "<a href="http://claim.name">claim.name</a>": "preferred_username",</font></div><div><font face="monospace, monospace"> "access.token.claim": "true"</font></div><div><font face="monospace, monospace"> }</font></div><div><font face="monospace, monospace"> },</font></div><div><font face="monospace, monospace"> {</font></div><div><font face="monospace, monospace"> "protocolMapper": "oidc-usermodel-property-mapper",</font></div><div><font face="monospace, monospace"> "protocol": "openid-connect",</font></div><div><font face="monospace, monospace"> "name": "family name",</font></div><div><font face="monospace, monospace"> "consentText": "${familyName}",</font></div><div><font face="monospace, monospace"> "consentRequired": true,</font></div><div><font face="monospace, monospace"> "config": {</font></div><div><font face="monospace, monospace"> "user.attribute": "lastName",</font></div><div><font face="monospace, monospace"> "jsonType.label": "String",</font></div><div><font face="monospace, monospace"> "id.token.claim": "true",</font></div><div><font face="monospace, monospace"> "<a href="http://claim.name">claim.name</a>": "family_name",</font></div><div><font face="monospace, monospace"> "access.token.claim": "true"</font></div><div><font face="monospace, monospace"> }</font></div><div><font face="monospace, monospace"> },</font></div><div><font face="monospace, monospace"> {</font></div><div><font face="monospace, monospace"> "protocolMapper": "oidc-usermodel-property-mapper",</font></div><div><font face="monospace, monospace"> "protocol": "openid-connect",</font></div><div><font face="monospace, monospace"> "name": "email",</font></div><div><font face="monospace, monospace"> "consentText": "${email}",</font></div><div><font face="monospace, monospace"> "consentRequired": true,</font></div><div><font face="monospace, monospace"> "config": {</font></div><div><font face="monospace, monospace"> "user.attribute": "email",</font></div><div><font face="monospace, monospace"> "jsonType.label": "String",</font></div><div><font face="monospace, monospace"> "id.token.claim": "true",</font></div><div><font face="monospace, monospace"> "<a href="http://claim.name">claim.name</a>": "email",</font></div><div><font face="monospace, monospace"> "access.token.claim": "true"</font></div><div><font face="monospace, monospace"> }</font></div><div><font face="monospace, monospace"> },</font></div><div><font face="monospace, monospace"> {</font></div><div><font face="monospace, monospace"> "protocolMapper": "oidc-full-name-mapper",</font></div><div><font face="monospace, monospace"> "protocol": "openid-connect",</font></div><div><font face="monospace, monospace"> "name": "full name",</font></div><div><font face="monospace, monospace"> "consentText": "${fullName}",</font></div><div><font face="monospace, monospace"> "consentRequired": true,</font></div><div><font face="monospace, monospace"> "config": {</font></div><div><font face="monospace, monospace"> "id.token.claim": "true",</font></div><div><font face="monospace, monospace"> "access.token.claim": "true"</font></div><div><font face="monospace, monospace"> }</font></div><div><font face="monospace, monospace"> }</font></div><div><font face="monospace, monospace"> ]</font></div><div><font face="monospace, monospace">}</font></div></div><div><br></div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Sep 26, 2016 at 9:53 AM, Marek Posolda <span dir="ltr"><<a href="mailto:mposolda@redhat.com" target="_blank">mposolda@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
<div>It's strongly recommended to use our
keycloak.js adapter. It doesn't use cookies to maintain state. See
our examples for it in the example distribution. <br>
<br>
If you handle things manually, you need to care about various
things (like refreshes etc) and for logout, you of course need to
care of manually removing all the OAuth related state from your
application and possibly remove cookies (if your application is
using them).<span class="HOEnZb"><font color="#888888"><br>
<br>
Marek</font></span><div><div class="h5"><br>
<br>
<br>
On 22/09/16 02:01, Sean Schade wrote:<br>
</div></div></div><div><div class="h5">
<blockquote type="cite">
<div dir="ltr">Do I need to use the Keycloak JS adapter in our
Angular app in order to get logout to work correctly? I thought
we would be fine with just the openid-connect logout url. It
looks like the adapter clears the token in the browser.
<div><br>
</div>
<div><a href="https://github.com/keycloak/keycloak/tree/master/adapters/oidc/js/src/main/resources" target="_blank">https://github.com/keycloak/<wbr>keycloak/tree/master/adapters/<wbr>oidc/js/src/main/resources</a><br>
</div>
<div><br>
</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Wed, Sep 21, 2016 at 2:08 PM, Sean
Schade <span dir="ltr"><<a href="mailto:sean.schade@drillinginfo.com" target="_blank">sean.schade@drillinginfo.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">Thanks Scott for replying. We don't use an
adapter. We have an Angular app that makes HTTP calls to
backend services. All of our services are behind a
Keycloak Security Proxy.
<div><br>
</div>
<div>We are migrating away from Oracle OAM to Keycloak,
and with Oracle navigating to the logout link was
sufficient. I assumed the same would be for Keycloak. </div>
<div><br>
</div>
<div>I initially thought this might be the bug: <a href="https://issues.jboss.org/browse/KEYCLOAK-3311" target="_blank">https://issues.jboss.org/<wbr>browse/KEYCLOAK-3311</a></div>
<div><br>
</div>
<div>However, after looking at the logs in Keycloak when I
click the Logout button in our app I see the following
errors.</div>
<div><br>
</div>
<div>
<p><span>18</span><span>:</span><span>55</span><span>:</span><span>10</span><span>,</span><span>630</span><span>
WARN [org.jboss.resteasy.resteasy_j<wbr>axrs.i18n]
(</span><span>default</span><span> task-</span><span>11</span><span>)
RESTEASY002130: </span><span>Failed</span><span> to
parse request.: javax.ws.rs.core.</span><span>UriBuilderExc<wbr>eption</span><span>:
RESTEASY003330: </span><span>Failed</span><span> to
create URI: </span><span>null</span></p>
<p><span>
</span></p>
<ol>
<li><span></span><span>Caused</span><span> </span><span>by</span><span>:
javax.ws.rs.core.</span><span>UriBuilderExc<wbr>eption</span><span>:
RESTEASY003280: empty host name</span></li>
<li><span></span><span> at
org.jboss.resteasy.specimpl.</span><span>Re<wbr>steasyUriBuilder</span><span>.buildString(</span><span>R<wbr>esteasyUriBuilder</span><span>.java:</span><span>540</span><span>)</span></li>
<li><span></span><span> at
org.jboss.resteasy.specimpl.</span><span>Re<wbr>steasyUriBuilder</span><span>.buildFromValu<wbr>es(</span><span>ResteasyUriBuilder</span><span>.java:</span><span>743</span><span><wbr>)</span></li>
</ol>
<p><span><br>
</span></p>
<p><span>Perhaps it is a combination of the Keycloak
Security Proxy and some misconfiguration? I'm not
really sure at this moment.</span></p>
<p>Is my assumption correct that we do not need an
adapter for oidc logout?</p>
</div>
</div>
<div>
<div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Wed, Sep 21, 2016 at 1:29
PM, Scott Rossillo <span dir="ltr"><<a href="mailto:srossillo@smartling.com" target="_blank">srossillo@smartling.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word">Which adapter
are you using?
<div><br>
<div>
<div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word">
<div style="color:rgb(0,0,0);font-family:Helvetica;font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px">Scott
Rossillo</div>
<div style="color:rgb(0,0,0);font-family:Helvetica;font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px">Smartling
| Senior Software Engineer</div>
<div style="color:rgb(0,0,0);font-family:Helvetica;font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px"><a href="mailto:srossillo@smartling.com" target="_blank">srossillo@smartling.com</a></div>
<div style="color:rgb(0,0,0);font-family:Helvetica;font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px"></div>
</div>
</div>
<br>
<div>
<blockquote type="cite"><span>
<div>On Sep 21, 2016, at 2:03 PM, Sean
Schade <<a href="mailto:sean.schade@drillinginfo.com" target="_blank">sean.schade@drillinginfo.com</a>>
wrote:</div>
<br>
</span>
<div><span>
<div dir="ltr">We are having an issue
where our browser application will
initiate a logout, but after
redirecting back to the application
the user is not taken to the login
screen. It appears the user is still
logged in, and can fully access the
application. I can see the session
removed in Keycloak Admin UI.
However, it appears the cookie never
gets invalidated. Here is the
redirect URL we use. Are we missing
some configuration step in the
client? I have standard flow,
implicit flow, and direct access
grants enabled. Valid redirect URIs,
Base URL, and web origins are all
configured in the client. Admin URL
is not set as we are relying only on
browser logout.<br>
<div><br>
</div>
<div>
<pre style="font-family:consolas,"liberation mono",courier,monospace;font-size:12px;margin-top:0px;margin-bottom:0px;color:rgb(51,51,51);line-height:18px"><div style="padding-left:10px;min-height:18px"><span style="color:rgb(221,17,68)"><a href="https://auth.dev.drillinginfo.com/auth/realms/dev/protocol/openid-connect/logout?redirect_uri=https%3A%2F%2Fapp.dev.drillinginfo.com/gallery/" target="_blank">https://auth.dev.drillinginfo.<wbr>com/auth/realms/dev/protocol/o<wbr>penid-connect/logout?redirect_<wbr>uri=https%3A%2F%2Fapp.dev.dril<wbr>linginfo.com/gallery/</a></span></div></pre></div></div></span>
______________________________<wbr>_________________
keycloak-user mailing list
<a href="mailto:keycloak-user@lists.jboss.org" target="_blank">keycloak-user@lists.jboss.org</a>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" target="_blank">https://lists.jboss.org/mailma<wbr>n/listinfo/keycloak-user</a></div></blockquote></div>
</div></div></blockquote></div>
</div>
</div></div></blockquote></div>
</div>
<fieldset></fieldset>
<pre>______________________________<wbr>_________________
keycloak-user mailing list
<a href="mailto:keycloak-user@lists.jboss.org" target="_blank">keycloak-user@lists.jboss.org</a>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" target="_blank">https://lists.jboss.org/<wbr>mailman/listinfo/keycloak-user</a></pre>
</blockquote><p>
</p></div></div></div><br>______________________________<wbr>_________________<br>
keycloak-user mailing list<br>
<a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" rel="noreferrer" target="_blank">https://lists.jboss.org/<wbr>mailman/listinfo/keycloak-user</a><br></blockquote></div><br></div>