Hi Stan, The documentation doesn't mention this, but it seems the logout URL should be a POST, not a GET request. Is that true? So, I'm trying to create an HTML logout form with method post and action to the documented logout URL. The form has a submit button and two hidden fields: "client_id" and "client_secret". Clicking the submit button results in the following JSON response from the keycloak server: {"error":"invalid_request","error_description":"No refresh token"} So, I guess I need a third field, something like "refresh_token"? How would I get a refresh token? Remember I'm using the Wildfly client adapter and in my scenario the client is out-of-sync with the keycloak server (the user is logged into keycloak, but not the local client). Thanks, Ryan ----- Original Message ----- From: "Stan Silvert" <ssilvert(a)redhat.com&gt; To: "keycloak-user" <keycloak-user(a)lists.jboss.org&gt; Sent: Monday, August 13, 2018 7:15:15 PM Subject: Re: [keycloak-user] How to logout HttpServletRequest.logout() should not be a no-op.  It was implemented a long time ago: https://urldefense.proofpoint.com/v2/url?u=https-3A__issues.jboss.org_bro... If there is an issue with it you should report it in JIRA. Stan On 8/13/2018 4:19 PM, Ryan Slominski wrote: > Hi Keycloak Users, > > I'm using the Wildfly client adapter and trying to logout of Keycloak, even if a client application container doesn't think it is logged in. This is a problem because login state with Keycloak and login state with JSESSION_ID in servlet container are two separate things that can get out-of-sync. The documentation says you can logout in one of two ways: > > 1. Call HttpServletRequest.logout() > 2. Navigate to URL https://urldefense.proofpoint.com/v2/url?u=http-3A__auth-2Dserver_auth_re... {realm-name}/protocol/openid-connect/logout?redirect_uri=encodedRedirectUri > > See: https://urldefense.proofpoint.com/v2/url?u=https-3A__www.keycloak.org_doc... > > The first appears to be a no-op because the Java container itself isn't logged in, in this case. This does work if the client container is aware that it is logged in, but doesn't otherwise. The second also doesn't seem to do anything and just redirects back to redirect_uri. Any tips? > > A forceful logout is useful in the scenario when one client (client A) logs into Keycloak, and a different client (cilent B) wants to forcefully logout as to switch users. In this scenario client B doesn't think it is logged in because the client adapter is using container managed security with JSESSIONID, and locally the client isn't logged in. However if a login was attempted it would succeed automatically without prompting for a username and password and therefore the user wouldn't get a chance to provide an alternate username. A switch user ability is useful when users need to login with separate admin credentials or also in scenarios where a user says "move over and I'll drive" to a colleague. > > Thanks, > > Ryan > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org > https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.jboss.org_mail... _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.jboss.org_mail...