Skip to content

add logout_hint to broker browser logout url #42355

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dasniko wants to merge 1 commit into from
Closed

add logout_hint to broker browser logout url #42355

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions js/apps/admin-ui/maven-resources/theme/keycloak.v2/admin/messages/messages_en.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3172,6 +3172,8 @@ defaultValueHelp=Default value when attribute value is not specified.
to the attribute. For that, make sure to use any of the built-in validators to properly validate the size and the values.
sendIdTokenOnLogout=Send 'id_token_hint' in logout requests
sendIdTokenOnLogoutHelp=If the 'id_token_hint' parameter should be sent in logout requests.
sendLogoutHintOnLogout=Send 'logout_hint' in logout requests
sendLogoutHintOnLogoutHelp=If enabled, the 'logout_hint' parameter in the logout request will be added with the value of the 'login_hint' parameter from the id_token.
sendClientIdOnLogout=Send 'client_id' in logout requests
sendClientIdOnLogoutHelp=If the 'client_id' parameter should be sent in logout requests.
addAttributeTranslationBtn=Add translation button
Expand Down
5 changes: 5 additions & 0 deletions js/apps/admin-ui/src/identity-providers/add/DescriptorSettings.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,6 +98,11 @@ const Fields = ({ readOnly }: DescriptorSettingsProps) => {
isDisabled={readOnly}
stringify
/>
<DefaultSwitchControl
name="config.sendLogoutHintOnLogout"
label={t("sendLogoutHintOnLogout")}
stringify
/>
<DefaultSwitchControl
name="config.sendClientIdOnLogout"
label={t("sendClientIdOnLogout")}
Expand Down
4 changes: 4 additions & 0 deletions js/apps/admin-ui/src/identity-providers/add/ExtendedNonDiscoverySettings.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,10 @@ export const ExtendedNonDiscoverySettings = () => {
label="sendIdTokenOnLogout"
defaultValue={"true"}
/>
<SwitchField
field="config.sendLogoutHintOnLogout"
label="sendLogoutHintOnLogout"
/>
<SwitchField
field="config.sendClientIdOnLogout"
label="sendClientIdOnLogout"
Expand Down
16 changes: 16 additions & 0 deletions services/src/main/java/org/keycloak/broker/oidc/OIDCIdentityProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,7 @@
import org.keycloak.sessions.AuthenticationSessionModel;
import org.keycloak.util.JsonSerialization;
import org.keycloak.util.TokenUtil;
import org.keycloak.utils.StringUtil;
import org.keycloak.vault.VaultStringSecret;

import java.io.IOException;
Expand Down Expand Up @@ -173,6 +174,7 @@ protected void backchannelLogout(UserSessionModel userSession, String idToken) {
public Response keycloakInitiatedBrowserLogout(KeycloakSession session, UserSessionModel userSession, UriInfo uriInfo, RealmModel realm) {
if (getConfig().getLogoutUrl() == null || getConfig().getLogoutUrl().trim().equals("")) return null;
String idToken = userSession.getNote(FEDERATED_ID_TOKEN);
String loginHint = extractLoginHintFromIdToken(idToken);
if (getConfig().isBackchannelSupported()) {
backchannelLogout(userSession, idToken);
return null;
Expand All @@ -183,6 +185,9 @@ public Response keycloakInitiatedBrowserLogout(KeycloakSession session, UserSess
if (getConfig().isSendIdTokenOnLogout() && idToken != null) {
logoutUri.queryParam("id_token_hint", idToken);
}
if (getConfig().isSendLogoutHintOnLogout() && StringUtil.isNotBlank(loginHint)) {
logoutUri.queryParam("logout_hint", loginHint);
}
if (getConfig().isSendClientIdOnLogout()) {
logoutUri.queryParam("client_id", getConfig().getClientId());
}
Expand All @@ -196,6 +201,17 @@ public Response keycloakInitiatedBrowserLogout(KeycloakSession session, UserSess
}
}

protected String extractLoginHintFromIdToken(String idToken) {
Comment thread
dasniko marked this conversation as resolved.
if (StringUtil.isBlank(idToken)) return null;
try {
JsonNode jsonNode = JsonSerialization.readValue(parseTokenInput(idToken, false), JsonNode.class);
return jsonNode.path("login_hint").asText();
} catch (IOException | IdentityBrokerException e) {
logger.warn("Failed to extract loginHint from id_token.", e);
return null;
}
}

@Override
protected Response exchangeStoredToken(UriInfo uriInfo, EventBuilder event, ClientModel authorizedClient, UserSessionModel tokenUserSession, UserModel tokenSubject) {
FederatedIdentityModel model = session.users().getFederatedIdentity(authorizedClient.getRealm(), tokenSubject, getConfig().getAlias());
Expand Down
12 changes: 10 additions & 2 deletions services/src/main/java/org/keycloak/broker/oidc/OIDCIdentityProviderConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,12 +16,12 @@
*/
package org.keycloak.broker.oidc;

import static org.keycloak.common.util.UriUtils.checkUrl;

import org.keycloak.common.enums.SslRequired;
import org.keycloak.models.IdentityProviderModel;
import org.keycloak.models.RealmModel;

import static org.keycloak.common.util.UriUtils.checkUrl;

/**
* @author Pedro Igor
*/
Expand Down Expand Up @@ -80,6 +80,14 @@ public void setSendIdTokenOnLogout(boolean value) {
getConfig().put("sendIdTokenOnLogout", Boolean.valueOf(value).toString());
}

public boolean isSendLogoutHintOnLogout() {
return Boolean.parseBoolean(getConfig().getOrDefault("sendLogoutHintOnLogout", Boolean.TRUE.toString()));
}

public void setSendLogoutHintOnLogout(boolean value) {
getConfig().put("sendLogoutHintOnLogout", Boolean.valueOf(value).toString());
}

public String getPublicKeySignatureVerifier() {
return getConfig().get("publicKeySignatureVerifier");
}
Expand Down
Loading