Single Logout (SLO) does not work as expected between Keycloak and Grafana

Grafana Authentication
1

Hi Community,

We are experiencing an issue where Single Logout (SLO) does not work as expected between Keycloak and Grafana.

Setup:
Keycloak version: 23.0.3

Grafana version: v10.3.3

use generic auth for configuring keycloak.

Logout URL configured in Grafana generic oauth:
“http://keycloak-server/realms/realm-name/protocol/openid-connect/logout?
post_logout_redirect_uri=grafana-server”

Expected Behavior:
Logging out from the Keycloak console ( any other client application) should
terminate all active sessions, including those in Grafana.

Actual Behavior:
Even after logging out from the Keycloak console:
Sedsion in Grafana remain active.

Steps to Reproduce:
Configure Grafana to authenticate via Keycloak using generic oauth.
Log in to grafana using Keycloak.
Log out from the Keycloak console (or another client).

Observe that Grafana server sessions are still active.

Is there any additional configuration required on the grafana side to properly support SLO?

Any help or guidance would be appreciated.
Thanks in advance

2

That’s Back-Channel Logout, which is not implemented in the Grafana.

3

Hi @jangaraj ,

Thank you for confirming that back-channel logout is not currently implemented in Grafana. Could you please let us know:

  1. When will this feature be implemented?
  2. Is it on the development backlog?

Your guidance on this matter is crucial for our furture development

Best regards
Saif

4

I know nothing about it. I’m not a Grafana employee, so I don’t have any access to those plans.