KeyCloakAuthenticator: 'redirect_uri' parameter is deprecated for post-logout redirect in Keycloak

[jezwilkinson]

Hi, I am trying to integrate KeyCloakAuthenticator into an instance of JupyterHub - Using Keycloak 24.0.3 and KeyCloakAuthenticator v4.0.0, when I click the "log out" button in my JupyterHub control panel it gives a browser error "We are sorry... invalid parameter: redirect_uri". This seems to be because the "redirect_uri" parameter is no longer accepted for logout by default in Keycloak (should be "?post_logout_redirect_uri=http://..." with either "&client_id={CLIENT_ID}" or "&id_token_hint=...")

In Keycloak's debug logs:

2024-11-01 13:41:14,266 WARN [org.keycloak.events] (executor-thread-69) type="LOGOUT_ERROR", realmId="[realmId]", clientId="null", userId="null", ipAddress="[ipaddress]", error="invalid_request"
2024-11-01 13:41:14,266 WARN [org.keycloak.protocol.oidc.endpoints.LogoutEndpoint] (executor-thread-69) Parameter 'redirect_uri' no longer supported. Please use 'post_logout_redirect_uri' with 'id_token_hint' for this endpoint. Alternatively you can enable backwards compatibility option 'legacy-logout-redirect-uri' of oidc login protocol in the server configuration.

If I enable the backwards compatibility option with the switch "--spi-login-protocol-openid-connect-legacy-logout-redirect-uri=true" on the Keycloak server then the error on logout is bypassed, but then Keycloak gives a warning " Deprecated switch 'legacy-logout-redirect-uri' is enabled. Please try to disable it and update your clients to use OpenID Connect compliant way for RP-initiated logout." and it's not clear if this switch will still be supported in future versions.

The handling of the post-logout redirect is done in the following lines in auth.py - since the "redirect_uri" string is hardcoded here it is also not possible for me to replace it with the correct form of the redirect in my jupyterhub_config.

jupyterhub-extensions/KeyCloakAuthenticator/keycloakauthenticator/auth.py

Lines 166 to 170 in 8b624d7

	if self.enable_logout and end_session_url:
	if self.logout_redirect_url:
	end_session_url += '?redirect_uri=%s' % self.logout_redirect_url
	# Update parent class OAuthenticator.logout_redirect_url
	self.logout_redirect_url = end_session_url