Vault oidc/logout

Vault
1

Hi there,

I am using KeyCloak as my external Identity Provider, this allows users to login via OIDC.

The issue arises at the point of ending the user session.  Users are able to logout from Vault, however their KeyCloak session is unaltered.

Then when the user tries to re-authenticate, following the traditional re-direct flow, the expected challenge is skipped and the user is automatically logged in.  So far my work around has been to log into KeyCloak and terminate the user’s session locally - this is not be practical in a production environment.

Similarly, when the session is terminated in KeyCloak, Vault is not updated.

I have looked at the browser’s Dev console network tab.  My research suggests a ‘logout’ token should be passed to the identity provider but I haven’t seen that.

The usual flow of requests to Vault as I understand it from the Dev console is: health?.., seal-status

On logout this is interrupted briefly with mounts.

My goal is to end the OIDC session when the user logs out of Vault.  In a user management scenario, shouldn’t the session state synchronise between Vault and the Identity Provider?

–
Stephen.

2

This is thread is expressing the same issue. I am posting this link in the hope that it will garner more attention and promote the importance of this issue.

3

Hi @sf-greensill , Happy New year!!

Maybe you already have a solution for your issue, because I have the same.

Thanks a lot, waiting for your feedback.

4

Hi Stephen,
I found a solution.
It’s Not a Bug, It’s a Feature !!!

Have a good week.

5

Hi. I am still seeing this issue. I don’t believe it is a feature, it should be real issue.

I configured vault with oidc Azure. And after I logout from vault, I am still able to login to vault without getting prompted by identity/password challenge.

Please take a good example on grafana. I configured oauth Azure in grafana. In grafana, I am able to login and then fully logout from grafana.

After I logout from grafana, I will be prompted back the Azure login screen when I attempt to login back to the grafana.

6

To note, the vault I am using is version 1.10.4

7

And to note again, grafana has config so called “signout_redirect_url” that will serve as a hook to trigger Azure/keycloak to perform logout on their side

8

The year is 2025. The problem remains unresolved.

As a workaround, you can manually log out by following this link (example for Keycloak):
https://KEYCLOAK_HOST/realms/KEYCLOAK_REALM/protocol/openid-connect/logout