1

I'm using keycloak gatekeeper to protect a simple front-end web application and it works well; users need to log in before they get to the actual site.

The problem is logging OUT. When I use the /oauth/logout URL, it seems to destroy the local session in the app, but does not actually log the user out. The next time I refresh, the user is logged in again.

I checked the keycloak gatekeeper logs and whenever I hit the logout URL I see this;

error invalid response from revocation endpoint {"status": 400, "response": "{\"error\":\"invalid_grant\",\"error_description\":\"Invalid refresh token\"}"}

error no session found in request, redirecting for authorization {"error": "authentication session not found"}

info issuing access token for user {"email": "test@test.com", "expires": "2019-11-08T12:11:35Z", "duration": "4m59.409151193s"}

It looks like it tries to call the revocation-url, fails, and then just logs the user in again. The question is why the call to the revocation-url fails. I did not set up anything custom, this is just keycloak + keycloak-gatekeeper pretty much out-of-the-box.

Can anyone shed some light on this?

Here is the gatekeeper config (deployed in Kubernetes);

secure-cookie: false
client-id: dashboard
client-secret: xxx
discovery-url: https://xxx/auth/realms/dashboard
enable-default-deny: true
encryption_key: xxx
listen: 0.0.0.0:3000
redirection-url: https://domain.tld
upstream-url: http://127.0.0.1:80
Gerard
  • 107
  • 1
  • 7
  • What is offered by used IdP - end_session_endpoint or revocation_endpoint? – Jan Garaj Nov 08 '19 at 22:32
  • the used IdP is keycloak, which offers revocation_endpoint as far as I am aware. I also tried the same config with a hard-coded revocation-url set to the /auth/realms/dashboard/protocol/openid-connect/logout (or something like that) and the same thing happens - that endpoint returns a 400 with invalid_refresh_token the moment gatekeeper calls it. – Gerard Nov 10 '19 at 09:38

1 Answers1

2

Invalid refresh token => you need to enable refresh tokens:

enable-refresh-tokens: true
encryption-key: <your enryption key>
Jan Garaj
  • 25,598
  • 3
  • 38
  • 59
  • 1
    This did the trick! As a side note; some users got into a weird redirect loop, because their sessions had already timed out and there were no refresh tokens. I had to manually delete the cookies for them before they got into a sensible flow again. Just in case anyone runs into that. – Gerard Nov 20 '19 at 07:56