Support RP (Client) initiated logout

[jzheaux]

Summary

end_session_endpoint is part of the OIDC spec:

http://openid.net/specs/openid-connect-session-1_0.html#RPLogout

Additional Info

This is born out of some observations from @thomasdarimont in a OAuth github sample.

[jzheaux]

@thomasdarimont, quick question about the way Keycloak supports RP-initiated logout.

The way I read the spec for RP-logout:

"In this case, the RP, after having logged the End-User out of the RP, redirects the End-User's User Agent to the OP's logout endpoint URL."

is that the RP would do a redirect as opposed to a server-side call.

Is a server-side call the preferred way in Keycloak, or is that just isolated to your sample?

Also, I'm wondering if you see something different in the spec than I. We want to remain spec compliant in the implementations that Spring Security provides and hopefully make it easy to extend for folks who need to depart from the spec. Do you see a server-side call as within the bounds of the OpenID spec?

I found the following article to be informative, relative to what kinds of flows are possible within the spec.

[thomasdarimont]

In my example I do the logout behind the scenes since I want to stay in the application.
But I could also just send an redirect, which might be more appropriate.

Keycloak currently supports multiple ways to access the end_session endpoint:

• via GET with id_token as URL parameter
  IMHO this is as specified in the OpenID Connect Session Spec
• via POST with id_token in request body
  Having not looked to deep into that particular spec, but from looking at the implementation this IMHO looks like the Backchannel logout spec

The current version of Keycloak seems to lack support for the Front Channel logout though.

I didn't have time to read the full article yet - will do and get back to this later.

[jzheaux]

Cool, thanks for the links.

Reading the Backchannel logout spec, it appears that is a way for RPs to register an endpoint and that the OP initiates the logout. Note that section 3, "RP-intiiated Logout Functionality" just refers back to the session management spec.