fix: keycloak authentication post logout redirect for Keycloak 18+

server/models/users.js

@@ -866,7 +866,7 @@ module.exports = class User extends Model {
  }
  const usr = await WIKI.models.users.query().findById(context.req.user.id).select('providerKey')
  const provider = _.find(WIKI.auth.strategies, ['key', usr.providerKey])
- return provider.logout ? provider.logout(provider.config) : '/'
+ return provider.logout ? provider.logout(provider.config, context) : '/'
  }
 
  static async getGuestUser () {

server/modules/authentication/keycloak/authentication.js

@@ -21,7 +21,7 @@ module.exports = {
  clientSecret: conf.clientSecret,
  callbackURL: conf.callbackURL,
  passReqToCallback: true
- }, async (req, accessToken, refreshToken, profile, cb) => {
+ }, async (req, accessToken, refreshToken, results, profile, cb) => {
  let displayName = profile.username
  if (_.isString(profile.fullName) && profile.fullName.length > 0) {
  displayName = profile.fullName
@@ -36,18 +36,30 @@ module.exports = {
  picture: ''
  }
  })
+ req.session.keycloak_id_token = results.id_token
  cb(null, user)
  } catch (err) {
  cb(err, null)
  }
  })
  )
  },
- logout (conf) {
+ logout (conf, context) {
  if (!conf.logoutUpstream) {
  return '/'
  } else if (conf.logoutURL && conf.logoutURL.length > 5) {
- return `${conf.logoutURL}?redirect_uri=${encodeURIComponent(WIKI.config.host)}`
+ const idToken = context.req.session.keycloak_id_token
+ const redirURL = encodeURIComponent(WIKI.config.host)
+ if (conf.logoutUpstreamRedirectLegacy) {
+ // keycloak < 18
+ return `${conf.logoutURL}?redirect_uri=${redirURL}`
+ } else if (idToken) {
+ // keycloak 18+
+ return `${conf.logoutURL}?post_logout_redirect_uri=${redirURL}&id_token_hint=${idToken}`
+ } else {
+ // fall back to no redirect if keycloak_id_token isn't available
+ return conf.logoutURL
+ }
  } else {
  WIKI.logger.warn('Keycloak logout URL is not configured!')
  return '/'

server/modules/authentication/keycloak/definition.yml

@@ -57,4 +57,9 @@ props:
  title: Logout Endpoint URL
  hint: e.g. https://KEYCLOAK-HOST/auth/realms/YOUR-REALM/protocol/openid-connect/logout
  order: 9
+ logoutUpstreamRedirectLegacy:
+ type: Boolean
+ title: Legacy Logout Redirect
+ hint: Pass the legacy 'redirect_uri' parameter to the logout endpoint. Leave disabled for Keycloak 18 and above.
+ order: 10