CODEWITHSUNDEEP
keycloak
Franck
Franck

Reputation: 986

What is the back channel logout url for a Keycloak used as an Identity Broker?

We use Keycloak as an Identity Broker which delegates user authentication to an external Identity Provider.

This external Identity Provider needs the back channel logout url of Keycloak to end user session on this Keycloak when user logout from this external Identity provider.

I didn't see where I can find it in Keycloak admin interface or in Keycloak OpenID Endpoint Configuration.

It's not the "end_session_endpoint" because this is used for front channel logout (with browser interaction) not for a back channel call that doesn't involve a browser.

This is our configuration: MyApp -> MyKeycloak -> ExternalIDP

MyApp delegate authentication to my MyKeycloak

MyKeycloak delegate authentication to ExternalIDP

Now, user go to ExternalIDP and logout. ExternalIDP need to call the back channel logout URL for each application client like MyKeycloak.

Where I can find this URL ?

Upvotes: 1

Views: 8544

Answers (2)

Fabio Formosa
Fabio Formosa

Reputation: 1084

It's /realms/{realm-name}/protocol/openid-connect/logout/backchannel-logout
ref: https://www.keycloak.org/docs/latest/server_admin/#con-server-oidc-uri-endpoints_server_administration_guide

Upvotes: 3

dominic detta
dominic detta

Reputation: 221

The backchannel logout feature is located in the page OpenID Connect settings/Advanced of your external identity provider. Activate the flag Backchannel logout.

Here an image to show exactly the location of the button enter image description here

Upvotes: 0

Related Questions