Logout from Keycloak no longer works with Keycloak 18.0.0

[chrisx8]

The issue

The "Logout from Keycloak on Logout" option in the Keycloak authentication strategy no longer works with Keycloak 18.0.0.

Keycloak 18 removed support for the redirect_uri parameter on the OIDC logout endpoint for security reasons.

If I enable the "Logout from Keycloak on Logout" option and configure the "Logout Endpoint URL", I will be redirected to https://keycloak.example.com/realms/my-realm/protocol/openid-connect/logout?redirect_uri=https%3A%2F%2Fwiki.example.com. Since this includes the removed redirect_uri parameter, I get this error from Keycloak:

Invalid parameter: redirect_uri

Expected behavior

"Logout from Keycloak on Logout" works properly.

Potential solutions

• Implement the new logout strategy. From Keycloak 18.0.0 release notes:

  It is possible to omit the confirmation and do automatic redirect to the application when you include parameter post_logout_redirect_uri together with the parameter id_token_hint with the ID Token used for login.

  • Recommended solution from Keycloak developers.
• Don't include the redirect_uri parameter with Keycloak logout requests.
  • Probably trivial to fix, but users will need to confirm logout with Keycloak, and they won't be redirected back to Wiki.js after logout.
• Remove the Keycloak authentication strategy, and switch to the "Generic OpenID Connect / OAuth2" strategy (which supports Keycloak OIDC, and logout works as expected - because redirect_uri is not sent).
  • Since Keycloak supports OIDC, this would remove the duplicated effort (two nearly identical auth strategies). However, like the previous fix, users will need to confirm logout with Keycloak, and they won't be redirected back to Wiki.js after logout.

References

• keycloak 18.0.0 release notes
• OpenID Connect Logout in Keycloak 18.0.0 upgrading guide

[rkkotnik]

Any updates on this?

[aurorasmiles]

There is an open pull request #5878 to fix this issue, but it hasn't been merged yet