OIDC backchannel Logout : multiple sessions on same client, only one backchannel request

Before reporting an issue

• I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

authentication

Describe the bug

In backchannel logout of our OIDC client implementation, I noticed the following behavior in Keycloak when multiple sessions exist.

Steps : Log in the user in the same client using, e.g., two browsers. You will see two sessions for the registered OIDC client in Keycloak On the user’s sessions tab, click on “Logout all sessions”.

This results in one single backchannel request being triggered from keycloak. where in logout_token, I can see sid of only one of the active sessions

Now you can imagine that the client itself may have internal session information (session cookie) that need to be invalidate/terminate as a result of the backchannel request

However, it is impossible for the client to identify which of the sessions to actively terminate, as seemingly only one of the active sessions in Keycloak will be submitted as a backchannel logout request.

How can client identify which all sessions to terminate?

Version

23.0.7

Regression

• The issue is a regression

Expected behavior

I would have expected one request per session to get both SID logout requests in the client

Actual behavior

Keycloak sending sid of one of the sessions

How to Reproduce?

Log in the user in the same client using, e.g., two browsers. You will see two sessions for the registered OIDC client in Keycloak On the user’s sessions tab, click on “Logout all sessions”.

Anything else?

No response