[keycloak-user] KEYCLOAK SAML logout not working as documented

[Manuel Waltschek]

Hello KC Community,

I am still trying to find out how to properly logout from keycloak using the kc adapter on wildfly10.
Documentation says

3.1.8. Logout

There are multiple ways you can logout from a web application. For Java EE servlet containers, you can call HttpServletRequest.logout(). For any other browser application, you can point the browser at any url of your web application that has a security constraint and pass in a query parameter GLO, i.e. http://myapp?GLO=true. This will log you out if you have an SSO session with your browser.
As HttpServletRequest.logout() in Undertows implementation io.undertow.servlet.spec.HttpServletRequestImpl checks isInvalidateSessionOnLogout returns false in my case it does not much.

    @Override
    public void logout() throws ServletException {
        SecurityContext sc = exchange.getSecurityContext();
        sc.logout();
        if(servletContext.getDeployment().getDeploymentInfo().isInvalidateSessionOnLogout()) {
            HttpSession session = getSession(false);
            if(session != null) {
                session.invalidate();
            }
        }
    }

Im calling HttpServletRequest.logout() in a ServletFilter implementation, but it does not  end the keycloak session and I can still reach protected ressources. There is no backchannel request as I would expect.
When I do the following:

  private void requestGlobalLogout(HttpServletRequest req, HttpServletResponse resp)
      throws ServletException, IOException {
    String contextPath = req.getContextPath();
    req.logout();
    resp.sendRedirect(contextPath + "?GLO=true");

it somehow works, but sends another AuthnRequest before sending the LogoutRequest. Then the LogoutResponse ist posted to myapp/saml again which leads to http Status code 403 forbidden.

Please also see:

https://issues.jboss.org/browse/KEYCLOAK-2191

and https://lists.jboss.org/pipermail/keycloak-user/2017-July/011207.html


Regards,


[Logo]to m

Manuel Waltschek BSc.

+43 660 86655 47<tel:+436608665547>
manuel.waltschek at prisma-solutions.at<mailto:manuel.waltschek at prisma-solutions.at>
https://www.prisma-solutions.com

PRISMA solutions EDV-Dienstleistungen GmbH
Klostergasse 18, 2340 Mödling, Austria
Firmenbuch: FN 239449 g, Landesgericht Wiener Neustadt
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 6418 bytes
Desc: image001.png
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20190617/10ce8ff6/attachment-0001.png