Description

The target of this epic is to make sure that Keycloak is able to be certified with OIDC related profiles https://openid.net/certification/#OPs and with logout profiles (See section "Certified OpenID Providers for Logout Profiles" at the bottom of this page). Especially frontchannel logout profiles.

From the generic profiles, we target everything with the exception of "3rd Party-Init OP" .

For the logout profiles, we target all 4 profiles.

Document with the current state of failing tests of OIDC testsuite and related issues: https://docs.google.com/document/d/1yKg_F-pG0NPz3pxLtDc7g288d7jAC8f0leABh50BZn0

Discussion

1642

Issues

• Logout takes forever when realm has many clients #8761 #8762
• Support for frontchannel_logout_session_required OIDC client parameter #10137
• Documentation for frontchannel logout and other logout mechanisms is up-to-date #10139
• Make sure that OIDC conformance testsuite passes for logout and normal profiles #10146
• Support for post_logout_redirect_uris in OIDC client registration #10135
• Keycloak does not support POST method mentioned in latest OIDC RP-Initiated Logout specs draft #11958
• Add support for client_id parameter in OIDC RP-Initiated logout endpoint #12002
• Changing locale on logout confirmation strips redirect_uri parameter #11951
• the param id_token_hint in OpenID Connect Logout #11915
• Documentation for latest logout changes keycloak-documentation#1545
• Remove redirect_uri support from OIDC logout endpoint #10983
• Backchannel Logout silently not sent, if Frontchannel Logout is enabled as well #15058
• Align admin console for client for backchannel and frontchannel logout #10138
• Frontchannel logout not propagated to all clients when mix of OIDC and SAML clients in the session #17318
• Front-channel Single Log-Out propagation from SAML IdP to OIDC #36944
• Single Logout not redirecting user to the requested logout uri when logged into OIDC and SAML clients #21770
• OIDC: Backchannel logout not being called when using Sign out all Session in Keycloak  #27342
• OIDC backchannel Logout : multiple sessions on same client, only one backchannel request  #27359
• Backchannel logout notification client for Update_Password AIA is not having all the session ids #32124

Motivation

No response