As you can see, the request contains a mandatory parameter named token. If Keycloak does not find that parameter, then it throws a HTTP #400: Token not provided (see code here).
Environment
Keycloak server 10.0.2
Proxy 10.0.0
Expected Results
The proxy is able to request the revocation of a refresh token when setting the configuration parameter revocation-url to the URL of the new token revocation endpoint that is provided by Keycloak.
Actual Results
The proxy passes a parameter named refresh_token (instead of token - see code here) and receives an error from Keycloak. As a consequence, it cannot log the user out anymore.
Steps to reproduce
Run the proxy against Keycloak 10+.
Set the revocation-url to https://<keycloak>/realms/<realm-name>/protocol/openid-connect/revoke.
Enable the refresh tokens.
enable-refresh-tokens: true
encryption-key: xxx
Login and logout through the proxy.
You should see this in the log:
error invalid response from revocation endpoint {"status": 400, "response": "{\"error\":\"invalid_request\",\"error_description\":\"Token not provided\"}"}
Proxy is not compatible with new token revocation endpoint of Keycloak 10
Summary
Starting from the version 10.0.0, Keycloak exposes a new token revocation endpoint that implements the RFC 7009.
The RFC 7009 states that the revocation of a refresh token can be requested as followed:
As you can see, the request contains a mandatory parameter named
token
. If Keycloak does not find that parameter, then it throws aHTTP #400: Token not provided
(see code here).Environment
Expected Results
The proxy is able to request the revocation of a refresh token when setting the configuration parameter
revocation-url
to the URL of the new token revocation endpoint that is provided by Keycloak.Actual Results
The proxy passes a parameter named
refresh_token
(instead oftoken
- see code here) and receives an error from Keycloak. As a consequence, it cannot log the user out anymore.Steps to reproduce
revocation-url
tohttps://<keycloak>/realms/<realm-name>/protocol/openid-connect/revoke
.