# OAuth/OpenID logout with Keycloak

**URL:** <https://discourse.nodered.org/t/oauth-openid-logout-with-keycloak/57492>\
**Category:** General\
**Tags:** security\
**Created:** [30 January 2022 10:25 UTC](https://discourse.nodered.org/t/oauth-openid-logout-with-keycloak/57492 "2022-01-30T10:25:30Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![mw75](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/mw75/32/52490_2.png) [@mw75](https://discourse.nodered.org/u/mw75)\
**Post date:** [30 January 2022 10:25 UTC](https://discourse.nodered.org/t/oauth-openid-logout-with-keycloak/57492/1 "2022-01-30T10:25:30Z")

</div>

This is not a question, but a simple note for others using Keycloak to authenticate node-red users.

I followed the hints at [OAuth/OpenID login with Keycloak](https://discourse.nodered.org/t/oauth-openid-login-with-keycloak/54144) and got my login working very fast. I decided to go with keycloack roles instead of groups but overall the logic remains the same.

The only problem i encountered was the logout. After a successful login i clicked logout, got the Node-Red-sign-in modal but after clicking that button i was immediately logged in with the previews used account because my keycloak session was still active.

Passport exposes a logout() that should be attached to the logout route but i could not find a usable hook in node-red to use it. I went through the code and found the solution in @node-red/editor-api/lib/auth/index.js. By setting settings.editorTheme.logout. redirect to  
http://{KEYCLOAK\_URL}/auth/realms/{REALM\_NAME}/protocol/openid-connect/logout?redirect\_uri={NODE-RED-EDITOR-URL-URIENCODED}  
you can loop through the session invalidation of keycloak and everything works as expected.

On request i could add an keycloak integration manual for the documentation. Would that be of interest? What documentation entrypoint should be used (@knolleary )? Is there someone who could review and correct my none-native-english?

Regards,  
Mario

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [30 January 2022 10:30 UTC](https://discourse.nodered.org/t/oauth-openid-logout-with-keycloak/57492/2 "2022-01-30T10:30:40Z")

</div>

Thanks for sharing @mw75

It would be helpful to add a bit about the `logout` property to [Securing Node-RED : Node-RED](https://nodered.org/docs/user-guide/runtime/securing-node-red#oauthopenid-based-authentication)

It would also be very helpful to have a page of examples for different auth providers.

I would suggest creating a new page: `docs/user-guide/runtime/security/examples.md` and adding a section for Keycloak.

We can then add links to that from the appropriate places in the 'securing node-red' page.

---

<div class="post-metadata">

**Author:** ![mw75](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/mw75/32/52490_2.png) [@mw75](https://discourse.nodered.org/u/mw75)\
**Post date:** [30 January 2022 11:52 UTC](https://discourse.nodered.org/t/oauth-openid-logout-with-keycloak/57492/3 "2022-01-30T11:52:31Z")

</div>

I just started to document the over all process and discovered an other problem: When i try to login with a valid user who is not assigned to the required role, the revoke function is not triggered and i can not leave the wrong user context.

I have no access to the express res-resource inside the passport-verify function to redirect myself and i don't see an option to configure the session destroy loop on strategy errors. The handleStrategyError function in @node-red/editor-api/lib/auth/index.js just redirects to settings.httpAdminRoot. Any hint how to get the logout-loop integrated would be appreciated.

BTW: The err argument of the verify-done() callback is interpreted as a string and attached to the session\_message queryparameter of the settings.httpAdminRoot redirection. A string of "not authorized" will be URI encoded and becomes "not%20authorized" on the sign-in modal. How to bypass that? I tried "not&nbsp;authorized" but the ampersand is not quoted in the process and messes up the query-string what results in the message "not" on the modal.

---

<div class="post-metadata">

**Author:** ![mw75](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/mw75/32/52490_2.png) [@mw75](https://discourse.nodered.org/u/mw75)\
**Post date:** [30 January 2022 12:19 UTC](https://discourse.nodered.org/t/oauth-openid-logout-with-keycloak/57492/4 "2022-01-30T12:19:10Z")

</div>

@quarfie as known keycloak user: Have you discovered the same issue? Do you have any suggestions or workarounds?

---

<div class="post-metadata">

**Author:** ![quarfie](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/quarfie/32/39697_2.png) [@quarfie](https://discourse.nodered.org/u/quarfie)\
**Post date:** [30 January 2022 14:50 UTC](https://discourse.nodered.org/t/oauth-openid-logout-with-keycloak/57492/5 "2022-01-30T14:50:25Z")

</div>

I do not seem to be having this issue.

When I click logout, it takes me to the Node-RED sign-in page, like so:

 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/e/b/eb2f1b21b0a05f9d1b66bca8c6fe3f495a6fd65d.png)

I am definitely logged out at this time. I cannot get back to the editor by clicking back or refreshing, etc.

When I click the sign in button, I get taken to my Keycloak login, which includes a "login with Google" button. Depending on how recently I last logged in with Google, this might complete the process and sign me in or I might have to provide my Google credentials.

---

<div class="post-metadata">

**Author:** ![mw75](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/mw75/32/52490_2.png) [@mw75](https://discourse.nodered.org/u/mw75)\
**Post date:** [30 January 2022 21:25 UTC](https://discourse.nodered.org/t/oauth-openid-logout-with-keycloak/57492/6 "2022-01-30T21:25:31Z")

</div>

Ok, that means you bypass the hole keycloak sso session by the google delegation. So you are not affected by that behavior.

@knolleary would it be an option to apply

```auto
$ diff node_modules/@node-red/editor-api/lib/auth/index.js ~/red/node_modules/@node-red/editor-api/lib/auth/index.js 
188c188
< options.verify.apply(null,args);
---
> options.verify.apply(this,args);

```

that would allow a this.redirect call with http://{KEYCLOAK\_URL}/auth/realms/{REALM\_NAME}/protocol/openid-connect/logout?redirect\_uri={NODE-RED-EDITOR-URL-URIENCODED - even with "?session\_message=Unauthorized" appended} inside the verify function and solve the problem without side effects. this is the Strategy object in this case.

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [30 January 2022 21:35 UTC](https://discourse.nodered.org/t/oauth-openid-logout-with-keycloak/57492/7 "2022-01-30T21:35:10Z")

</div>

It's hard to review a proposed code change out of context in a forum post.

Please raise a PR with enough detail to explain what this does. This isn't an area of the code base I can comment in with spending time reminding myself how it all works.

---

<div class="post-metadata">

**Author:** ![mw75](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/mw75/32/52490_2.png) [@mw75](https://discourse.nodered.org/u/mw75)\
**Post date:** [31 January 2022 09:03 UTC](https://discourse.nodered.org/t/oauth-openid-logout-with-keycloak/57492/8 "2022-01-31T09:03:54Z")

</div>

[OAuth/OpenID logout with Keycloak - Forum 57492 by mw75 · Pull Request #3388 · node-red/node-red · GitHub](https://github.com/node-red/node-red/pull/3388) also filled with more context

---

<div class="post-metadata">

**Author:** ![mw75](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/mw75/32/52490_2.png) [@mw75](https://discourse.nodered.org/u/mw75)\
**Post date:** [5 February 2022 07:49 UTC](https://discourse.nodered.org/t/oauth-openid-logout-with-keycloak/57492/9 "2022-02-05T07:49:00Z")

</div>

Any feedback, here or on the PR, would be appreciated @knolleary and @all!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [6 April 2022 07:49 UTC](https://discourse.nodered.org/t/oauth-openid-logout-with-keycloak/57492/10 "2022-04-06T07:49:17Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.