stevenmaguire / oauth2-keycloak

Keycloak Provider for OAuth 2.0 Client
MIT License
204 stars 151 forks source link

Allow redirect without id_token_hint #60

Open JimPanse2k19 opened 1 year ago

JimPanse2k19 commented 1 year ago

I think, the last changes in this implementation

https://github.com/stevenmaguire/oauth2-keycloak/blob/34e4824f5fa26aa8e90f1258859c75570c12d27a/src/Provider/Keycloak.php#L160-L169

does not represent the current specs on https://openid.net/specs/openid-connect-rpinitiated-1_0.html where it says, that a id_token parameter is recommended but not mandatory. This current implementation does not allow to have the redirect without a token anymore, which is wrong. The line $params['post_logout_redirect_uri'] = $params['redirect_uri']; should be outside the if statement.