Guidance Needed: Keycloak Single Logout Implementation

[atul tiwari]

Hi Team,

I have two projects running — one in rails and one in Superset. I’m using Keycloak for authentication, and in both projects I manage sessions through browser cookies. Once a user logs in to my app via Keycloak, I create a session and store it in the browser for further request authorization. SSO login across both apps is working fine.

The challenge I’m facing is with logout. I want to achieve single logout so that logging out from one app logs the user out from all other applications in real time. I’ve explored both front-channel and back-channel logout, but haven’t found a concrete solution yet.

Below are my observations so far:

1. API Session Validation

   • Implement session validation by calling the Keycloak API on every request.

   • Limitation: This would add multiple API calls to the server, impacting performance.

2. Redis-based Session Management

   • Store session data in Redis instead of browser cookies. Each request can then be validated against Redis.

   • Limitation: If Redis becomes unavailable, the login flow will be completely blocked.

3. Front-Channel Logout

   • Keycloak uses iframes to trigger logout URLs for each client.

   • Limitation: Fragile due to iframe-related issues (third-party cookie blocking, CSP, X-Frame-Options, browser privacy restrictions).

4. Back-Channel Logout

   • Works via server-to-server logout notifications.

   • Limitation: This is not effective in my current setup since sessions are stored only in browser cookies, and the server has no visibility into them.

I’d like to know what would be the recommended approach to manage sessions and implement a robust single logout flow in this scenario. Any best practices or industry-standard approaches would be very helpful.

Thanks,
Atul

[Alexander Schwartz]

Hello Atul,

Thank you for reaching out. This mailing list is about developing Keycloak itself, not about developing applications that interface with Keycloak. 

Your question would be better handled on the Keycloak user mailing list: https://groups.google.com/g/keycloak-user

Best,

Alexander

--
You received this message because you are subscribed to the Google Groups "Keycloak Dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to keycloak-dev...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/keycloak-dev/835cab1a-a571-4fe6-8f75-606fe0585536n%40googlegroups.com.

--

Alexander Schwartz, RHCE

He/Him

Principal Software Engineer, Keycloak Maintainer

alexander...@ibm.com

IBM Data Privacy Statement 

IBM Deutschland Research & Development GmbH

Vorsitzender des Aufsichtsrats: Wolfgang Wendt

Geschäftsführung: David Faller

Sitz der Gesellschaft: Böblingen / Registergericht: Amtsgericht Stuttgart, HRB 243294