Bug: Logout does not log out on auth provider

[soofstad]

Bug: Logout does not log out on auth provider

[soofstad]

Nevermind, with a bit more digging I found this; https://datatracker.ietf.org/doc/html/rfc7009#section-2.1

Which should be considered the only answer on how the revoke/logout feature should be handled.

[soofstad]

Hi, thanks for reporting this bug. I will have a look at it as soon as I got some time on my hands.

Could you provide which URL(logout url) and auth provider you are experiencing this with?

[rferreira98]

Hi there 👋

It's a custom auth provider. I noticed the logoutRedirect is never used in your source code.
I'm using a not so good workaround which is basicly redirecting the user to the logout url after logging out.

[soofstad]

Thanks, yes I saw that as well 😐

Will add that ASAP. Just to make sure. Your custom auth provider expects a POST request with the AUTHENTICATION header and no body right?

This has been postponed as it's not described in the OAuth2 spec, but many providers support this features. The problem is they might expect many different request.

Ether way, Keycloak expects this;

Headers

{
 "Authorization" : "Bearer <access_token>",
 "Content-Type" : "application/x-www-form-urlencoded"
}

Body

{
    "client_id" : "<client_id>",
    "refresh_token" : "<refresh_token>"
}

Method

POST

Which I think can be considered a somewhat unofficial standard