Details
-
Feature Request
-
Resolution: Done
-
Minor
-
13.0.0
-
None
Description
Frontchannel logout could be implemented on Keycloak as specified in Draft: OpenID Connect Front-Channel Logout 1.0 - draft 04
Some relevant OIDC client implementations like mod_auth_oidc already support
Initialized from https://groups.google.com/g/keycloak-dev/c/GZr-qL2cquE/m/QSneckXrBQAJ
Suggested changes:
- Add enum to LoginFormsPage to represent frontchannel transition page.
- Add enum to filename mapping on keycloak/forms/login/freemarker/Templates.
- Add createFrontchannelLogoutPage() interface to LoginFormsProvider.
- Add createFrontchannelLogoutPage() implementation to FreeMarkerLoginFormsProvider.
- Implement frontchannelLogout(UserSessionModel userSession, AuthenticatedClientSessionModel clientSession) on OIDCLoginProtocol.
- Alter finishLogout(UserSessionModel userSession) on OIDCLoginProtocol.
- Show checkbox for frontchannel logout for OIDC protocol and add a text field for client attribute frontchannel_logout_url on theme/base/admin/resources/partials/client-detail.html
- Create template theme/base/login/frontchannel-logout.ftl
- Translations on theme/base/login/messages/messages_en.properties and theme/base/admin/messages/messages_en.properties
Some work done:
Including frontchannel logout Tests
Attachments
Issue Links
- is blocked by
-
KEYCLOAK-15221 Backchannel Logout sid Claim not provided in ID Token
-
- Closed
-
- is duplicated by
-
KEYCLOAK-2939 OpenID Connect Front-Channel Logout
-
- Closed
-
- mentioned on