Hi Mark, You can see my other thread to Hynek Mlnarik about logout and cookies. It's sort of a JSF issue, I suppose, more than a KC issue. Actually, I'l just copy the email here. The TLDR; version is : JSF redirect on logout loses cookies, so has to re-auth with KC before logging out. Which means the first logout doesn't 'take'. Hi Hynek, My setup is exactly from that tutorial. And I found the problem with logging out, I'm not sure how to report the issue (not sure if it's really a KC issue at all), raise a Jira ticket? Setup: JEE app running JSF calling EJBs. JEE app using wildfly keycloak saml adapters to talk to Keycloak (KC)Keycloak setup to use ADFS as its IdP. Problem: JEE app needs to logout twice to logout. (That is, after first logout, you can still hit the protected resource on the JEE app without logging in again) Cause: 1) first logout:- JSF's redirects (externalContext.redirect(externalContext.getRequestContextPath() + "/?GLO=true" );) removes the jsessionId cookie, which causes an initial auth from JEE to KC when logout is hit. -rest of logout proceeds properly, Realm Session ID is removed from KC, ADFS logs use out. 2) second logout-JSF's redirect again removes the jsessionId cookie, tries to do an initial auth from JEE to KC, but KC doesn't have any sessions to auth user with, and user is kicked out, 'successfully' logging out. Solution: preserve the jsessionid on redirect, initial auth to KC doesn't occur on logout.    public void logout() throws IOException, ServletException    {       ExternalContext externalContext = _context.getExternalContext();       try       {          externalContext.invalidateSession();          _httpRequest.logout();       }       catch (Exception ex)       {          _logger.error(ex);       }       finally       {          // need to set the cookie for the jsessionid, or will re-auth with KC, and will require two logouts to logout completely          preserveJsessionidCookie(externalContext);          externalContext.redirect(externalContext.getRequestContextPath() + "/?GLO=true" );       }    }    private void preserveJsessionidCookie(ExternalContext externalContext)    {       for (Cookie cookie : ((HttpServletRequest)externalContext.getRequest()).getCookies())       {          if (cookie.getName().equalsIgnoreCase("jsessionid"))          {             ((HttpServletResponse)externalContext.getResponse()).addCookie(cookie);             break;          }       }    } Cheers, Thanks, Jason On Tuesday, July 11, 2017, 11:59:41 PM PDT, Marek Posolda <mposolda(a)redhat.com&gt; wrote: You can check our SAML examples in the keycloak-examples distribution. They're doing logout. Marek On 05/07/17 20:40, Jason Spittel wrote: