Logout with keycloak 18.0.2

[HoussemGargouri]

Hi,

In version 15 of Keycloak we used the logout with the :

URL : https://auth..../oidc-callback?logout=<..>

We are currently working on updating the version of Keycloak to 18. So this URL no longer works because it requires a new parameter id_token_hint which is currently not provided with this module. Is there a way to solve this problem?

we had log in our keycloak server :

{"timestamp":"2022-07-22T15:09:08.769Z","sequence":8539,"loggerClassName":"org.jboss.logging.Logger","loggerName":"org.keycloak.protocol.oidc.endpoints.LogoutEndpoint","level":"WARN","message":"Parameter 'id_token_hint' is required when 'post_logout_redirect_uri' is used.","threadName":"executor-thread-25","threadId":116,"mdc":{},"ndc":"","hostName":"keycloak1","processName":"QuarkusEntryPoint","processId":1} {"timestamp":"2022-07-22T15:09:08.778Z","sequence":8540,"loggerClassName":"org.jboss.logging.Logger","loggerName":"org.keycloak.events","level":"WARN","message":"type=LOGOUT_ERROR, realmId=usagers, clientId=null, userId=null, ipAddress=88.127.129.209, error=invalid_request","threadName":"executor-thread-25","threadId":116,"mdc":{},"ndc":"","hostName":"keycloak1","processName":"QuarkusEntryPoint","processId":1}

Thx !

[zandbelt]

Most probably you're using OIDCSessionType client-cookie? Because when using server-side caching mechanism - the default - the id_token_hint is added to the logout request. However, when using client-cookie the id_token will not be stored in the session (i.e. the cookie) because of cookie size constraints and thus it is not available to add as a parameter at logout time and as such is omitted.

[HoussemGargouri]

Yes that's true!

The URL of callback :

https://front..../oidc-callback/logout=....

redirect me to :

https://auth..../realms/myrealm/protocol/openid-connect/logout?post_logout_redirect_uri=....

which depends of the id_token_hint. Is there any way to force the redirect to :

https://auth..../realms/myrealm/protocol/openid-connect/logout?redirect_uri=.... ??

Thx !

[zandbelt]

for the record: support for storing the id_token in a client-cookie based session was added in 2.4.12 99373b6