Single Logout (SLO) does not work as expected between Keycloak and Grafana

jangaraj · May 14, 2025, 12:09pm

That’s Back-Channel Logout, which is not implemented in the Grafana.

Back channel OIDC logout

opened 08:05AM - 12 Mar 24 UTC

type/feature-request

Hello, lately RP initiated logout was iplemented in Grafana, which is great a…nd that you very much for that. What is still missing and I think is very important part of OIDC is backchannel logout: https://openid.net/specs/openid-connect-core-1_0.html#OpenID.BackChannel When offboarding a user for example, it would be nice to be able to logout user from SSO and the user would also be logged out from Grafana itself. Now we have to logout user separately, which kinda downgrades SSO usage. Other way I can think of would be that grafana checks if the user session in keycloak is still active and logout the user if its not. But thats not really a backchannel logout. Some software I've encountered handle it this way and it is good enough. But I havent found a way how to do this in Grafana either. Thank you very much.

Topic		Replies	Views
Grafana backchannel logout when connected to SSO or workaround Authentication	1	471	March 11, 2024
Single sign out Authentication	14	11493	October 14, 2024
Grafana API to logout keycloak authenticated user Authentication api , logout	0	710	December 9, 2022
OAuth2/OpenID Sign Out (Grafana + Keycloak) Authentication	11	11271	April 12, 2019
Graffana signout from Iframe in react application Authentication	3	1005	December 9, 2022

Single Logout (SLO) does not work as expected between Keycloak and Grafana

Related topics