search

kasmtech / workspaces-issues

18 stars 4 forks source link

[Bug] - Keycloak SSO integration does not seem to perform logout correctly #343

Open asubowo opened 1 year ago

asubowo commented 1 year ago

Existing Resources

Describe the bug OpenID integration with Keycloak doesn't seem to be initiating a front or back channel logout. After following the Kasm guide for Keycloak here, user login works as expected. No SSO issues are detected there. However when attempting to log out from Kasm, /api/logout is called and the user is sent to the static login page. However, if you click on the Keycloak SSO button on the screen will log you back in with the user that you authenticated with via Keycloak without being prompted for another login.

Calling the manual realm logout following Keycloak's specs here will clear the SSO session as expected.

To Reproduce Steps to reproduce the behavior:

  1. Log into Kasm via Keycloak SSO (in this case, example foo)
  2. Log out of Kasm using the drop down menu
  3. When redirected to the static login page, log into Kasm again via Keycloak SSO
  4. Notice that a prompt for logging in via Keycloak is skipped completely, and you're logged in as user foo again.

Expected behavior Clicking on logging out via Kasm web UI appropriately clears out SSO session

Screenshots If applicable, add screenshots to help explain your problem.

Workspaces Version Version 1.12, containerized

Workspaces Installation Method Single server

Client Browser (please complete the following information):

Workspace Server Information (please provide the output of the following commands):

Additional context Followed Keycloak setup following Kasm guide. Tried setting a multitude of front-channel and back-channel URLs in the client with no luck.

j-travis commented 1 year ago

Thanks for the feedback.

I think the main issue is that when we implemented OIDC, there was no official support or spec for front/back channel logout mechanism like you would find for SAML - so not many IdPs exposed that functionality. It looks like the 1.0 specs were released in September of 22.

We will look into this in future revisions.

A workaround for now would be to use SAML instead of OIDC.

asubowo commented 1 year ago

Great! One thing to note for SAML setup following the documentation, instead of username I had to set the NameID Attribute in Kasm to unspecified in order to pull the username. Though emailAddress will also work just peachy too.

Looking forward to seeing OIDC complete! Thanks for listening.