[BUG] Single Sign out Keycloak OIDC about rancher

[torsten-online]

Hi @piyushchhajed02.

I think when you logout of Rancher and already logged into Keycloak, so its normally expected and not a bug!

I tried to simulate this on my dev environment with Rancher 2.8.4 deployed:

When I logged in with Keycloak OIDC / OpenID, then I can logout of Rancher.

For the final logout (invalidate keycloak session), its required to visit keycloak logout URL/Button, for example available at Keycloak-Url

I hope this information helps you for solving the related "Bug/Issue".

Have a lot of Fun
Torsten

[piyushchhajed02]

Ideally when i click on the Rancher logout button it should auto redirect to the Keycloak logout URL, So that user session gets invalidated.

But in current case when I logout from Rancher and try to login again it would directly allow the user in withould asking for credentials.

[torsten-online]

Correct, that means a logout from Rancher is not a logout from Keycloak. So we have here a "normal SSO behavior", when there is no option to configure a logout url ... as its done for rancher.

I think you should request this as "Feature" for configure a logout url. As I said, its not a bug.
Normally you can also logout of keycloak, then you are logged out of rancher also. Thats working fine