[keycloak-user] Keycloak spring-boot-adapter logout session from keycloak.

[saloni udani]

Hi

I have a spring-boot 2 application which I am trying to secure with
Keycloak. I have used  'keycloak-spring-boot-2-starter' adapter.

Following is my security configuration
--------

import org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver;
import org.keycloak.adapters.springsecurity.authentication.KeycloakAuthenticationProvider;
import org.keycloak.adapters.springsecurity.config.KeycloakWebSecurityConfigurerAdapter;
import org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticatedActionsFilter;
import org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticationProcessingFilter;
import org.keycloak.adapters.springsecurity.filter.KeycloakPreAuthActionsFilter;
import org.keycloak.adapters.springsecurity.filter.KeycloakSecurityContextRequestFilter;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.authority.mapping.SimpleAuthorityMapper;
import org.springframework.security.core.session.SessionRegistryImpl;
import org.springframework.security.web.authentication.logout.LogoutFilter;
import org.springframework.security.web.authentication.preauth.x509.X509AuthenticationFilter;
import org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy;
import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;
import org.springframework.security.web.csrf.CookieCsrfTokenRepository;

@ConditionalOnProperty(value = "keycloak.enabled")
@Configuration
@EnableWebSecurity
public class KeycloakSecurityConfiguration extends
KeycloakWebSecurityConfigurerAdapter {


@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws
Exception {
    KeycloakAuthenticationProvider keycloakAuthenticationProvider =
keycloakAuthenticationProvider();
    keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(new
SimpleAuthorityMapper());
    auth.authenticationProvider(keycloakAuthenticationProvider);
}

@Bean
public KeycloakSpringBootConfigResolver keycloakConfigResolver() {
    return new KeycloakSpringBootConfigResolver();
}

// Specifies the session authentication strategy
@Bean
@Override
protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
    return new RegisterSessionAuthenticationStrategy(new SessionRegistryImpl());
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    super.configure(http);
    http
        .csrf().disable()
        .addFilterBefore(keycloakPreAuthActionsFilter(), LogoutFilter.class)
        .exceptionHandling().authenticationEntryPoint(authenticationEntryPoint())
        .and()
        .logout()
        .logoutUrl("/logout")
        //.invalidateHttpSession(true)
        //.deleteCookies("JSESSIONID")
        .and()
        .authorizeRequests()
        .antMatchers("/").hasRole("superuser").anyRequest().permitAll();
}

@Bean
public FilterRegistrationBean
keycloakAuthenticationProcessingFilterRegistrationBean(
    KeycloakAuthenticationProcessingFilter filter) {
    FilterRegistrationBean registrationBean = new
FilterRegistrationBean(filter);
    registrationBean.setEnabled(false);
    return registrationBean;
}

@Bean
public FilterRegistrationBean keycloakPreAuthActionsFilterRegistrationBean(
    KeycloakPreAuthActionsFilter filter) {
    FilterRegistrationBean registrationBean = new
FilterRegistrationBean(filter);
    registrationBean.setEnabled(false);
    return registrationBean;
}

@Bean
public FilterRegistrationBean keycloakAuthenticatedActionsFilterBean(
    KeycloakAuthenticatedActionsFilter filter) {
    FilterRegistrationBean registrationBean = new
FilterRegistrationBean(filter);
    registrationBean.setEnabled(false);
    return registrationBean;
}

@Bean
public FilterRegistrationBean keycloakSecurityContextRequestFilterBean(
    KeycloakSecurityContextRequestFilter filter) {
    FilterRegistrationBean registrationBean = new
FilterRegistrationBean(filter);
    registrationBean.setEnabled(false);
    return registrationBean;
}


}

--------

Following are the keycloak properties from application.properties
--------

keycloak.enabled=true
keycloak.auth-server-url=http://localhost:8180/auth
keycloak.realm=MyRealm
keycloak.resource=my-app
keycloak.public-client=true

keycloak.security-constraints[0].authRoles[0]=superuser
keycloak.security-constraints[0].securityCollections[0].patterns[0]=/*


--------
Now the default logoutSuccessfulUrl used by KeycloakLogoutHandler is '/'
which is my secure endpoint. So when I do logout in application, it hits
'/' and automatically logs in again as the session with Keycloak does not
get deleted on logout.

If I change logoutSuccessfulUrl to some unsecure endpoint , then the
session from keycloak seems to get deleted.And from that unsecure page if I
try to hit secure page, it asks for login as expected.

So here I am trying to understand that in which scenario the session from
Keycloak should be deleted(logged out) when we fire logout from
application? What is the difference in both the above mentioned logout
scenario?


Thanks