10:57 a.m.
Few things, which we can possibly do:
- Currently when application initiates logout through
servletRequest.logout , it sends request to Keycloak logout endpoint.
This endpoint then sends backchannel request to all logged clients with
registered admin URL. I think we can improve here and not send request
to the original application, which initiated logout.
For example: When product-portal application initiates logout through
servletRequest.logout, the adapter itself should be already able to do
all logout actions on it's side (invalidate httpSession etc) and there
is no need to send another request from keycloak to product-portal to
logout same httpSession.
- Backchannel logout requests send by Keycloak (ResourceAdminManager)
could be send in parallel. Currently they are send sequentially, which
is not very optimal.
WDYT?
Marek
1:39 p.m.
Why not just kick off the backchannel logout requests sent by Keycloak asynchronously? The
logout requesting app can’t do anything if they fail anyway.
Scott Rossillo
Smartling | Senior Software Engineer
srossillo(a)smartling.com
On Feb 11, 2016, at 11:57 AM, Marek Posolda
<mposolda(a)redhat.com> wrote:
Few things, which we can possibly do:
- Currently when application initiates logout through
servletRequest.logout , it sends request to Keycloak logout endpoint.
This endpoint then sends backchannel request to all logged clients with
registered admin URL. I think we can improve here and not send request
to the original application, which initiated logout.
For example: When product-portal application initiates logout through
servletRequest.logout, the adapter itself should be already able to do
all logout actions on it's side (invalidate httpSession etc) and there
is no need to send another request from keycloak to product-portal to
logout same httpSession.
- Backchannel logout requests send by Keycloak (ResourceAdminManager)
could be send in parallel. Currently they are send sequentially, which
is not very optimal.
WDYT?
Marek
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev
1:41 p.m.
There is one neat side-effect of current implementation in that it is
immediately apparent when backchannel events don't work due to
misconfiguration or firewall issues.
If the proposed optimisation is implemented I think we should add some
logging on the server that will make it very obvious when backchannel
events fail.
On Thu, Feb 11, 2016 at 5:57 PM, Marek Posolda <mposolda(a)redhat.com> wrote:
Few things, which we can possibly do:
- Currently when application initiates logout through
servletRequest.logout , it sends request to Keycloak logout endpoint.
This endpoint then sends backchannel request to all logged clients with
registered admin URL. I think we can improve here and not send request
to the original application, which initiated logout.
For example: When product-portal application initiates logout through
servletRequest.logout, the adapter itself should be already able to do
all logout actions on it's side (invalidate httpSession etc) and there
is no need to send another request from keycloak to product-portal to
logout same httpSession.
- Backchannel logout requests send by Keycloak (ResourceAdminManager)
could be send in parallel. Currently they are send sequentially, which
is not very optimal.
WDYT?
Marek
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev
2:42 p.m.
What I'm currently thinking is, that all backchannel logout requests can
be sent asynchronously, but the caller will wait for them until all the
responses are received.
Like if there are 4 clientSessions here:
https://github.com/keycloak/keycloak/blob/master/services/src/main/java/o...
, the "backchannelLogoutClientSession" will be triggered in 4 separate
threads, but then will wait until all of them are finished (Thread.join
or Future.get or something like that). In that case, Keycloak will be
still aware of all the logout requests success and failures. Currently
Keycloak is aware, but sending logout requests is sequential (request2
send after response1 is received) and that's far from optimal solution IMO.
Btv. I've just checked that when some logout request fails, we just log
it
https://github.com/keycloak/keycloak/blob/master/services/src/main/java/o...
. I guess we should also report it to LOGOUT Event to see which requests
were successful and which failed. That's another issue though, but is
quite related.
Marek
On 11/02/16 20:41, Marko Strukelj wrote:
There is one neat side-effect of current implementation in that it
is
immediately apparent when backchannel events don't work due to
misconfiguration or firewall issues.
If the proposed optimisation is implemented I think we should add some
logging on the server that will make it very obvious when backchannel
events fail.
On Thu, Feb 11, 2016 at 5:57 PM, Marek Posolda <mposolda(a)redhat.com> wrote:
> Few things, which we can possibly do:
>
> - Currently when application initiates logout through
> servletRequest.logout , it sends request to Keycloak logout endpoint.
> This endpoint then sends backchannel request to all logged clients with
> registered admin URL. I think we can improve here and not send request
> to the original application, which initiated logout.
>
> For example: When product-portal application initiates logout through
> servletRequest.logout, the adapter itself should be already able to do
> all logout actions on it's side (invalidate httpSession etc) and there
> is no need to send another request from keycloak to product-portal to
> logout same httpSession.
>
> - Backchannel logout requests send by Keycloak (ResourceAdminManager)
> could be send in parallel. Currently they are send sequentially, which
> is not very optimal.
>
> WDYT?
>
> Marek
> _______________________________________________
> keycloak-dev mailing list
> keycloak-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-dev
1:43 p.m.
There's also the option of doing logout via iframes in the browser. This
might be very useful for apps that need a browser logout.
On 2/11/2016 11:57 AM, Marek Posolda wrote:
Few things, which we can possibly do:
- Currently when application initiates logout through
servletRequest.logout , it sends request to Keycloak logout endpoint.
This endpoint then sends backchannel request to all logged clients with
registered admin URL. I think we can improve here and not send request
to the original application, which initiated logout.
For example: When product-portal application initiates logout through
servletRequest.logout, the adapter itself should be already able to do
all logout actions on it's side (invalidate httpSession etc) and there
is no need to send another request from keycloak to product-portal to
logout same httpSession.
- Backchannel logout requests send by Keycloak (ResourceAdminManager)
could be send in parallel. Currently they are send sequentially, which
is not very optimal.
WDYT?
Marek
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
2:08 p.m.
Also, OIDC adapter needs a ?GLO=true option like saml does.
For SAML it would be easy to implement this optimization. I don't think
OIDC has a way to determine who sent the logout reqest.
On 2/11/2016 2:43 PM, Bill Burke wrote:
There's also the option of doing logout via iframes in the
browser. This
might be very useful for apps that need a browser logout.
On 2/11/2016 11:57 AM, Marek Posolda wrote:
> Few things, which we can possibly do:
>
> - Currently when application initiates logout through
> servletRequest.logout , it sends request to Keycloak logout endpoint.
> This endpoint then sends backchannel request to all logged clients with
> registered admin URL. I think we can improve here and not send request
> to the original application, which initiated logout.
>
> For example: When product-portal application initiates logout through
> servletRequest.logout, the adapter itself should be already able to do
> all logout actions on it's side (invalidate httpSession etc) and there
> is no need to send another request from keycloak to product-portal to
> logout same httpSession.
>
> - Backchannel logout requests send by Keycloak (ResourceAdminManager)
> could be send in parallel. Currently they are send sequentially, which
> is not very optimal.
>
> WDYT?
>
> Marek
> _______________________________________________
> keycloak-dev mailing list
> keycloak-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-dev
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
2:50 p.m.
If application initiates logout via servletRequest.logout, the adapter
is using backchannel request to this endpoint -
https://github.com/keycloak/keycloak/blob/master/services/src/main/java/o...
. It is authenticated by client credentials and hence is aware which
client initiated the logout. There is also refreshToken and we have the
clientSession available in this refresh token. This is not OIDC standard
though, but we have that. So we can easily ommit this clientSession from
backchannel logout request by ResourceAdminManager.
Marek
On 11/02/16 21:08, Bill Burke wrote:
Also, OIDC adapter needs a ?GLO=true option like saml does.
For SAML it would be easy to implement this optimization. I don't think
OIDC has a way to determine who sent the logout reqest.
On 2/11/2016 2:43 PM, Bill Burke wrote:
> There's also the option of doing logout via iframes in the browser. This
> might be very useful for apps that need a browser logout.
>
> On 2/11/2016 11:57 AM, Marek Posolda wrote:
>> Few things, which we can possibly do:
>>
>> - Currently when application initiates logout through
>> servletRequest.logout , it sends request to Keycloak logout endpoint.
>> This endpoint then sends backchannel request to all logged clients with
>> registered admin URL. I think we can improve here and not send request
>> to the original application, which initiated logout.
>>
>> For example: When product-portal application initiates logout through
>> servletRequest.logout, the adapter itself should be already able to do
>> all logout actions on it's side (invalidate httpSession etc) and there
>> is no need to send another request from keycloak to product-portal to
>> logout same httpSession.
>>
>> - Backchannel logout requests send by Keycloak (ResourceAdminManager)
>> could be send in parallel. Currently they are send sequentially, which
>> is not very optimal.
>>
>> WDYT?
>>
>> Marek
>> _______________________________________________
>> keycloak-dev mailing list
>> keycloak-dev(a)lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-dev
3:02 p.m.
So you mean that we can have option to use logout iframe even in
server-side applications? Same stuff like we have in keycloak.js?
I guess it should work, but not sure about security implications. For
example the scenario like:
- User authenticated to customer-portal which is using iframe
- User opened tab with product-portal
- User closed the tab with customer-portal
- User sent logout request to product-portal. Now since the
customer-portal wasn't opened in browser, it is not immediately
available about logout and it's httpSession will be still valid. Session
will be logged-out later once user opens the customer-portal. I guess
it's not the big issue, the javascript apps also work the same way. But
not sure...
Marek
On 11/02/16 20:43, Bill Burke wrote:
There's also the option of doing logout via iframes in the
browser. This
might be very useful for apps that need a browser logout.
On 2/11/2016 11:57 AM, Marek Posolda wrote:
> Few things, which we can possibly do:
>
> - Currently when application initiates logout through
> servletRequest.logout , it sends request to Keycloak logout endpoint.
> This endpoint then sends backchannel request to all logged clients with
> registered admin URL. I think we can improve here and not send request
> to the original application, which initiated logout.
>
> For example: When product-portal application initiates logout through
> servletRequest.logout, the adapter itself should be already able to do
> all logout actions on it's side (invalidate httpSession etc) and there
> is no need to send another request from keycloak to product-portal to
> logout same httpSession.
>
> - Backchannel logout requests send by Keycloak (ResourceAdminManager)
> could be send in parallel. Currently they are send sequentially, which
> is not very optimal.
>
> WDYT?
>
> Marek
> _______________________________________________
> keycloak-dev mailing list
> keycloak-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-dev
2994
days inactive
2994
days old
7 comments
4 participants
participants (4)
-
Bill Burke -
Marek Posolda -
Marko Strukelj -
Scott Rossillo