Frontchannel logout not propagated to all clients when mix of OIDC and SAML clients in the session
#17,318 opened on 2023/02/27
Repository metrics
- Stars
- (34,398 個のスター)
- PR merge metrics
- (平均マージ 6d 19h) (30d で 384 merged PRs)
説明
Before reporting an issue
- I have searched existing issues
- I have reproduced the issue with the latest release
Area
core
Describe the bug
Multiple OIDC clients belonging to the same realm with active SSO sessions on the browser. When we implement Single Logout on any of the clients, the user session is logout automatically on the browser.
However, when we have a mixture of OIDC and SAML clients open and SLO is initiated, the user session is not logged out for all the clients on the browser. The user session is logged out correctly on the RH-SSO console.
The issue appears to be a client issue that is not triggering the logout from the browser when there is a mixture of both OIDC and SAML clients open.
Version
21.0.0
Expected behavior
Logout is propagated from Keycloak to all clients
Actual behavior
Logout is (at least sometimes) not propagated from Keycloak to all clients
How to Reproduce?
Mix of OIDC and SAML clients is needed and all needs frontchannel logout enabled. User needs to be logged to all those clients and then logout.
Anything else?
Possible related issue (maybe duplicate): https://github.com/keycloak/keycloak/issues/21770 . The issues should be likely fixed together.