Hi,
I am exploring on how to implement back channel logouts/ sso logout properly and have a
question in this regard.
I have a set of applications (say App1, App2, App3) which are integreated with keycloak
through servelet adapter (keycloak-servlet-adapters and keycloak-spring-boot2-adapters)..
Each of this application for HA/scalablity resons sit behind their own reverse proxies..
So typically there will be multiple instance of each application App1-Node1, App1-Node2..
App1-Node'n' , like wise App2-Node1,App2-Node2,App2-Node'n'.. and so on
for each of the Apps.
When a user u1,logs on to App1 and App2 an SSO session is establised in keycloak, and in
the user sessions i see that user has connected to clients App1 and App2 ( app1 and app2
are clients in keycloak realm)..
When user logged on App1-Node1 took the request, and for App2, App2-Node2 took the
request..
On the keycloak side, the admin urls are configured with the Reverse proxy url of the
each Apps ( same as the valid rediect and base url).
When a SSO logout happens, how can i ensure that the keycloak server sends the SSO logout
signal (k_logout) to the correct node? Will keycloak preserve the headers which came at
the time of orignial login request and use them while sending admin requests as well ? (
so that the reverse proxy could dispatch the request to correct node, assuming that the
application is configured to be sticky)..
Regards,Madhu
Show replies by date